Extracting prog: 24m21.866658667s Minimizing prog: 26m14.044046027s Simplifying prog options: 6m26.281693826s Extracting C: 2m37.054207848s Simplifying C: 0s 24 programs, 3 VMs, timeouts [15s 1m40s 6m0s] extracting reproducer from 24 programs single: executing 5 programs separately with timeout 15s testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-syz_emit_ethernet-syz_init_net_socket$llc-socket$nl_generic-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_GET_DEST-pipe-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-bpf$PROG_LOAD-close-close-socket$inet6_udplite-epoll_ctl$EPOLL_CTL_ADD-mmap-socket$inet6_sctp-socketpair-sendto$inet6-setsockopt$inet_sctp6_SCTP_INITMSG-setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD-ioctl$EXT4_IOC_SWAP_BOOT-socket$nl_netfilter-bpf$PROG_LOAD_XDP-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bind$llc-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000180)={@broadcast, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [@hopopts={0x2c}]}}}}}}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="0000000065a1f587b21600004acae67f2cd3dab53ac5652a641f2161d6e2d7aba3998d50ca29560971e15a74b13b2b5d32d9dd6c490eb101a472ad38ebba3c6317279abdd1039cd09e939ac1d2b6a20ff528bc104b3d86dd5b3398943dbb39f8cb241faf647cfaac5c786915e64dbd2cdf113975821fda0d8a4ba65a3a400959eace3f6b8a9cf88c9c98336c571ed6a4bfc10379912114fd3bc54d5df43338c0b0dfb3063cc1c548e422771836b02cdac693379b69073c70204dd00d11d51e73d4fdf8d135e3be5d31015a094ad23a1d5f49d55d5a73ec2c271227a872d4c6b98282cacc9536e43957da4588b05b019ead0a3d76ed25250ca1effd4caed7f692", @ANYRES16=r3, @ANYBLOB="100028bd7000fbdbdf250800000020000380060007004e2300001400020076657468305f6d61637674617000000008000500ff070000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x8001) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r6}, 0x4) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x1a0, 0x1a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x0, 0x10000000}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x13, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff000083a6340c715774ff000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000d0e94ad9ece636246f4b41126f85c29d0da327ad3f4c197b14548adf16c32bec8da20c5fb3fc073205c21edab3765d5e73aca6bd930d0346d217a7b9f38aad2a35d636f99f103b24917b3b4da2e0b341b64e32a6ce8ce8b1b30b4b0db865bd8766e52796", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000a00000085000000a50000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r4) close(r5) socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000010}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r1, 0x1a0a5000) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair(0x11, 0x3, 0x102, &(0x7f00000007c0)) sendto$inet6(r8, &(0x7f0000000100)='b', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000640)=[@in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x3, @remote, 0x3}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x7, @loopback, 0xff}, @in6={0xa, 0x4e21, 0x2, @empty, 0x6}, @in6={0xa, 0x4e24, 0x3f, @loopback, 0xe8d}], 0x9c) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x17, 0x3, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x60}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}, @IFLA_MTU={0x8, 0x4, 0x40000500}]}, 0x50}}, 0x0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_freezer_state-write$binfmt_misc-socket$nl_route-socketpair$unix-ioctl$int_in-connect$unix-sendmmsg$unix-recvmmsg-epoll_create1-epoll_ctl$EPOLL_CTL_ADD-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-setsockopt$bt_BT_DEFER_SETUP-socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$PROG_LOAD-sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS-epoll_pwait detailed listing: executing program 0: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-sendmsg$inet-recvmsg$kcm-openat$tun-ioctl$TUNSETIFF-socket$kcm-socket$inet6_sctp-socket$inet6_udplite-socket-socketpair$unix-bpf$ITER_CREATE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$l2tp6-setsockopt$IP6T_SO_SET_REPLACE-openat$cgroup_ro-openat$cgroup_ro-socket$nl_route-ioctl$sock_SIOCGIFINDEX_80211-ioctl-ioctl$SIOCSIFHWADDR-recvmsg$kcm-openat$cgroup_ro detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x350, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0x100, 0x128, 0x0, {}, [@common=@inet=@tcp={{0x30}}, @common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_freezer_state-write$binfmt_misc-socket$nl_route-socketpair$unix-ioctl$int_in-connect$unix-sendmmsg$unix-recvmmsg-epoll_create1-epoll_ctl$EPOLL_CTL_ADD-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-setsockopt$bt_BT_DEFER_SETUP-socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$PROG_LOAD-sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS-epoll_pwait detailed listing: executing program 0: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_freezer_state-write$binfmt_misc-socket$nl_route-socketpair$unix-ioctl$int_in-connect$unix-sendmmsg$unix-recvmmsg-epoll_create1-epoll_ctl$EPOLL_CTL_ADD-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-setsockopt$bt_BT_DEFER_SETUP-socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_CREATE-socket$inet_icmp_raw-bpf$PROG_LOAD-sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS-epoll_pwait detailed listing: executing program 0: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x10, 0x2, 0xaa4f}, 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 15s testing program (duration=21s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 19, 20, 23, 30, 5, 19, 12, 8, 26, 13, 24, 30, 18, 30, 30, 6, 26, 21, 19, 13, 26, 22, 30] detailed listing: executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509", 0x4e}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000900)=""/221, 0xdd}, {&(0x7f0000000d00)=""/249, 0xf9}, {&(0x7f0000002140)=""/4043, 0xfcb}, {&(0x7f0000000a00)=""/235, 0xeb}, {&(0x7f00000007c0)=""/182, 0xb6}, {&(0x7f0000000b00)=""/211, 0xd3}, {&(0x7f0000000600)=""/179, 0xb3}, {&(0x7f0000000cc0)=""/59, 0x3b}], 0x8}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=@framed, &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="25003300d0000000080211000001080211000000505050505050000003"], 0x44}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x0, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="61155000000000006113500000000000bfa000000000000007000000ee0016055e03010000000000250500000000000069163e0000000000bf07000000000000260507000fff0720670600003f000000140300000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871"], 0x0}, 0x90) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @union={0x0, 0x0, 0x0, 0xb, 0x0, 0x2}]}}, 0x0, 0x4e}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000002c0)="b9ff03076003008cb89e08f086dd", 0x0, 0x0, 0x60000000, 0x0, 0xfffffffffffffce7, 0x0, 0x0}, 0x50) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) socket(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x7c, 0x10, 0x421, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x0, 0x61}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x4}, @IFLA_GRE_OKEY={0x8, 0x5, 0xda4b}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e21}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x1}, @IFLA_GRE_ENCAP_DPORT={0x6}]}}}, @IFLA_LINK={0x8}, @IFLA_MASTER={0x8}, @IFLA_ADDRESS={0xa, 0x1, @dev}]}, 0x7c}}, 0x0) write$binfmt_misc(r5, &(0x7f0000000200)=ANY=[@ANYBLOB="4900030007"], 0xd) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x61}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r8, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r3, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x1}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4040814}, 0x48001) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b05d25a806c8c6f94f90424fc601000127a0a000612073582c137153e37080c18800bac0f000300", 0x33fe0}], 0x1, 0x0, 0x0, 0x8100000}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r9 = socket$netlink(0x10, 0x3, 0x4) writev(r9, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) executing program 3: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ff00ff85000000040000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$phonet(0x23, 0x2, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002e00)=ANY=[@ANYBLOB], 0x108}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'vlan0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000080)=0xf3e, 0x62) sendto$packet(r2, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001600)=ANY=[@ANYBLOB="1c0000002a000921bb5a8fffff0000000400002c24101a8004000400"], 0x1c}, 0x1, 0x3000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffff2) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r6, &(0x7f0000000000), 0x6e000) executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000700)={'wlan1\x00'}) r2 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f0000000200)) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r4}, 0x10) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r3, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000040)={0x6, 'veth1_vlan\x00'}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="f49362e343d7bd021e836690d26fa3c6080ad7bdcdc761326a3cdacff5445e0647e0925ad774247ae4d46ec34e167e7405e12e8b647c6f332c28d0a2c7eee22fbd6109992217733fa73cd8054ceef50b970861f66c2ec1fc6387ea048eab4357ba3d49727417c5ef893561447974fa07872377fd3f779b708de11b692a641d6b9ee3f711f5fc01e6cce6c933eb55fb09faf5f5e7980dda35609630ff8a04397f0d852b6daa1061287a65"], &(0x7f0000000000), 0xab, 0x0, 0xfffffffc, 0xfffffff9}, 0x20) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$pppl2tp(0x18, 0x1, 0x1) r7 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r6, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r7, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r5, 0x111, 0x2, 0x0, 0x20000000) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000fcffffff060000000000000085000000417d0000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0xc36}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, 0x0, 0x0}, 0x20) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={0xffffffffffffffff, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) recvmsg(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0xfffffd88) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r3, 0x0, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2b04a862}, 0x90) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="a40000001e00431b2bbd70000000000007000000"], 0xa4}}, 0x0) r6 = openat$cgroup_ro(r4, &(0x7f0000000440)='net_prio.prioidx\x00', 0x0, 0x0) getpeername$packet(r6, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000740)=0x14) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000004780)={'syz_tun\x00', &(0x7f0000000040)=@ethtool_link_settings={0x2}}) socket$kcm(0x10, 0x400000002, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4) executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYRES8=r0], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="1800000076000907000000000000000007020200f80b708d22834f7eb535f9e7e948396df783e8f33d5032321abd84386a5ed2f15058c4f6b9b769b50ad8faa70fb30bd4e232f5a120c86b32ba3d5d4e3aa40500000068ec7c3cf73e3dd0637fc849fe5f73cc9f6e390f9e8734001b51c91b21b0b0cba43193f74f9a76898024f1af413e3e402654bcadcf9af83f52793b06a90253da45d6b5b896faf0eced83ba0eccddeea3", @ANYRES32=0x0], 0x18}, 0x1, 0x5502000000000000}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bpf$ENABLE_STATS(0x20, &(0x7f0000000440), 0x4) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000040)={'wg1\x00', 0x0}) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000200), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000080)={&(0x7f0000000a40)="63d719522ba00183ec370649c931f93760f1e666a84b2480471c4ba34f41bb74a766ec3cd3ff36fdeb54ebd1ad58d03607fa1aa399a143be1ccd298cdd6ff1accaf2577b724f9110c7ebcbb1232152d5eebfafca9b1d1b301abd8032d12e826ba59b453ee90488f7cf0914394387a8e1dc47d9d92bcda1d25aac2aff2c8d7e8ee1c41f4788293ae69b7a29505071f9226730fa541946c850ee79fc57444dab17ec3cb12ff3de4920843a514f8a6b98282837966232f38ef7a3af7a26ba", &(0x7f0000000b00)=""/242, &(0x7f0000000c00)="73f9ddf78f5d3ad4933d69cdc49b3917c9ec6dd025b664732b31045f1bb8f70b463c087512724b578daf0596915baa3f327ed693368ba6b6928d86ff7ad599091d01fd74a050288826ed6bcd4f16fbff89b72e3e9336362aa426d5ae8bae8a461055f84105f6151a3803cb292569cc3d3623a2a3fdfc1d3aff1a19edb1edf3d155e0a6cafe9c5fc1f3", &(0x7f0000000cc0)="d00a202d82e01adf07f38cff3c7e95179ed439b5f243e6b27980f855868d248f39899b8abbf5d9d7483cb816e6c649565c19d0e637ebdd991c1ac71f8f6956da84ca1b4a947ced0ee2e3dd68bd5f549cc743bf26f547d1bacb6eae142f6724cdde786e48e6b661ee1a57f0e8f86afcab0cfdd9e44c185f07efcf1698bbfd73809d1dd91819d3d59cddbe0475a5b52148cbe70c0d934ac0f4cd3a464153f059373a4025a797e6ce44b3dcd5a7ea129ec369643414ee12a9ae92625b85dbeb3f251a0e1e5f41", 0x3}, 0x38) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)={0x4c, r10, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_FRAME={0x30, 0x33, @deauth={{{}, {}, @device_b}, 0x0, @val={0x8c, 0x10, {0x0, "0262c80200", @short="094c1f2501e02962"}}}}]}, 0x4c}}, 0x0) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r7, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={&(0x7f00000008c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="300029bd7000fedbdf255300000008000300", @ANYRES32=r11, @ANYBLOB="4c9222b8c19f7da62a060a5b2ead62acbf69050083f83b3649dd1c848fcdecea39f55df3793797e0d4fb844cf52fc2c4d254d3490def7f77e3a8c472b0e2951d7d0efde1b701c45b7adb2ce736cbb9e2844824b57b571cb8a9e6f4699983673ff352f5242ab5b6edae43bce347ecdeeb24f9c93ed0f5740de0f9496f511881ab93df5a460de0cc59edc2126a3d89c32cdb7a6c6f4715cf1dfdbea3cc6cc5b9527cb17e04edb9496619a3e5999a9148318f3c68d3d570c953b43de0312ef207b164aae1011a8b1f7a29275e6dc8e1df48222b70ad2df44b36e6d57be4b2870a901e9950c632088b00a2d81bbfdb93a479716a1fbb677729638b8d61c4013579619dcfd1fd21491601772f2ff23211ab5ae1cca9e10c7746f178b5bda08bb6cf7e02d9069d4361073dc1e5c745de3d39a5d6b0c9e64737d97a7b8ef63b80946dd59e8ac330b099"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r12, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)={0x104, r6, 0x405, 0x0, 0x0, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r5}, @WGDEVICE_A_PEERS={0xbc, 0x8, 0x0, 0x1, [{0xffffff9c, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "5577e9880050c7f502e96f1152ac2aa4cd9a9de7aa3f159b65412d9b8c39cac4"}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x0, @local}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x0, 0x0, @local}}, @WGPEER_A_FLAGS={0x8}, @WGPEER_A_PUBLIC_KEY={0x24}]}]}, @WGDEVICE_A_LISTEN_PORT={0x6}]}, 0x104}}, 0x0) getsockopt$rose(r3, 0x104, 0x6, 0x0, &(0x7f00000002c0)) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x3, &(0x7f0000000580)=@framed, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r13, 0x0, 0x8, 0x7, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_route(0x10, 0x3, 0x0) r14 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r15 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r15, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x18, 0x30, 0x1, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x290, 0x0, 0x150, 0x150, 0xd0, 0x90a, 0x1c0, 0x238, 0x238, 0x1c0, 0x238, 0xf, 0x0, {[{{@uncond, 0x500, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x8}}}}, {{@ipv6={@remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'dvmrp0\x00', 'netpci0\x00'}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f0) executing program 0: r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) listen(r0, 0x1ff) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f00000000c0)='}', 0x1, 0x0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) executing program 0: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r5}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 1: r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, 0x0, 0x0) listen(r0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000040)="e0", 0x1}], 0x1}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000980)='sys_exit\x00', r2}, 0x10) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) listen(r3, 0x0) accept$netrom(r3, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) executing program 3: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e22, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='westwood\x00', 0x9) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, 0x0) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000280)='g', 0x1}], 0x1) executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000200)={r1, 0x1, 0x6}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001fc0)=ANY=[@ANYBLOB="340000001800290200000000000000000200000008000000000000001500098008000000", @ANYRES32=0x0], 0x34}}, 0x0) r3 = socket(0x2, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000180)="759f3906d915ecc50a23ddb13ac813a75bb3f7e54d453e2a5aa757d57d897e1e709679ad8b5abbcf8fb36d", 0x2b, 0x0, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) setsockopt$EBT_SO_SET_ENTRIES(r3, 0xa00000000000000, 0x80, &(0x7f0000000000)=@broute={'broute\x00', 0x20, 0x1, 0x948, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000010000000068000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000b00000000000000000062726964676530000000000000000000626f6e645f736c6176655f3000000000736974300000000000000000000000007465716c3000000000000000000000000000000000000000000000000180c20000000000000000000000b8080000b8080000e8080000616d6f6e670000000000000000000000001b00000000000000000400000000001804000000000000000000000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d00000000fa0100000000000000000000000000000000000000000000000000000000004037118bc35d3037960000000000000000000000000000000000000000000000000000000000001f0000000000000000000000938d5e000000000000558d7a2006c2257800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e4f500000000000000000300020000000000000000006c00000000000000000000000000000000000000000000000000000000000000000000000000892f9284b45f00000000000000000000000000000000a600000000000000000000000040f9ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000080000001567cc0fb18ebd10677f000000000000000000000000b038562daba737bd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c50000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000ce90b91aedadb0c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ce113362da06e0fa83f39b50390000000000000000ed2c14bc1d077b4817d693d02c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000037ff1cf2f8e52e074300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d659920000000000e5c7ffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cbcb951a4f0f3300ebb39c00000000000000000000000000000000000000000000000000000000000000000000000000e70000000000053cbf7eee533b170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff80000ff0f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002292091a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c1a8a95ba6a3ba677371c303b5426300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c81e00"/2079]}, 0x897) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32", 0x8) r4 = accept$alg(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r4, &(0x7f0000000100)={'#! ', '', [], 0xa, "000000000000c93dd4fb1b25"}, 0x10) recvmmsg(r4, &(0x7f000000ec00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000006a40)=[{&(0x7f0000005380)=""/1, 0x1}], 0x1}}], 0x2, 0x0, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000000), 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001f80)={&(0x7f0000000340)=@pppol2tpv3in6={0x18, 0x1, {0x0, r3, 0x0, 0x4, 0x1, 0x2, {0xa, 0x4e20, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xe6}}}, 0x80, &(0x7f0000000e80)=[{&(0x7f00000001c0)}, {&(0x7f0000000440)="c511d616722fef1fa532865fe4ce053e52c5ac69da8cbbddb63e2fb55aed100ca9c4164ddf6c", 0x26}, {&(0x7f0000000e00)="3b31d64484e641d54cdcb728f0de0da32bac2f19b9bfb307e873093a3b19f3af01ef10e933a2f114327e4cdb18e696b360f0911263de124a0d89bd59d93f1662eb225abd1de9", 0x46}], 0x3, &(0x7f00000020c0)=ANY=[@ANYBLOB="10100000000000000d010000afffffffd624a44d730da7adf135eb1533acb970e4d860e0bc2a13901cd6f200e07d647e1c05f7baafaad51196ae8c7fea74aa0708fe9d0338090c309e130afcc3ff8a7ecb5079fcf96749df2bdeea51cb4b0b46cfa65942b1bc53964da55cf68f283ce46f4c2c4f8dd766abf3363a96b5ab38caa850e17152181a37be911716bb9e48869652cc4413789ca3ce53a961267b403c46ab8b9fa4c817449cad41295eb3b9210d2e881747b1d4330f82906792580dd750d98f42868c3e2e9d4e00c5567eabe0728f0b553cab9ceb02d4061ad88eb09ec14681a35a9bb818763c0bdff1d5fee6a3a51aece00efc3d2f5bda010bd83904e6ef426b7390e4d0e9f057b2895fa40c7fb9b61ddc0b5f144f9d1ab3249890561f57f5db7ae27bf3a574cc20624d52ad9aed33280139ceda357bdeffa53814db63647fbb8ea80565206dc7dfbd8b1f144def537e32c031fbcb3119b88a761aa98821a3ff0b1cac9b32f45d1a7233a1a8dfb517179f82ac0a4458761cdb50234433500aa46aa96d4ec14aa37afab47ab68016a6d1bc7ea8c4dba070371e4579147bb00f549c001b22c94ee6631f3e901014165bcbe00cc40219d80cf0dad6b8a5448d674d8d47afb9b4ff1ae0fe5707f8426a655ae7ec4f0603cf4cb27c2e291fa08b5f321b4e82b35d32c426bf0b1410838f4bbff6204821f303f7e8953005b34091b52796a524491c9b89c548460910496ad68341bf6c9bf9dacf6555b50cd32638786924c47e694f8ab60e632687a03f53f9e6f0ad60c7cfbe5a62d3c33de4bffdcc46730fc28c330fbaf461915a6e98814d8c37f9fa0a5799b905f6eb1147eed18a2aa2d60ea50873de0aed758c4e56419287d76cfc68c545847af1643481254433341d973c5cb41a690cca67d00db9dd5712a207aca657cd7b428d05b13eb60b957122367aa22c247f9b160897445f86f7defbf543cddf1de533097b35203850faca170d5c52da7f83ff27156c6e517c57109d6eb902d2cf36d972166ec3968af1fcadb430627e9f721a0526904f9be0c8a6dda7ee267b021c0406ac616d6f55f472d40d64e4cf352d569c4f5213e2c9a8fdd86ad834ccad031c1e561e5ae9d8ac5c0f80ee0aeaf99f25e300967f63328eb515c0af803e55a58e9c14c449e6c0f75482a8c6d704db9d4b38d2a9e189daeaac546f4df1e80d10c5cd9b95415edaedc01c1bc9e3fbaf4c42649af79000a4ee663602eb5d42232703a27dcbaca54b1d0d69535fa2dc9266e6c74311cf6f596d356dec7172d792190f45df4233713999e6baa86dcd131ead38cdad1aff2d0989c732543146d345dc0a1131b21f66028502fba79075c13d385767ab2415d64f689a4cc417a1aa509c5e4f4a59a0be5b21c1b90bbc7a4d754a318dedccefd93d5cad7a56790c02eed690607e3a0c00aa3564a6f9cab77561653b4397bc7584cb21d57f98107dbddb26082c55f596a04916364488248d34e78d0174264e60c54f3294495e86f1d936ab1c540c20360ac264a90497730db3027c649ab12447d83280ed74cbc9badafcc4337c3d86e9723f01805178b96a8c71d3580cd6acdeab345d2e8089b6c3beca14a2f8716e1ec9790e122bb46b3ae7f8318a2a2a1e0bff9f320dbbca1b2f6037f43aaa0528d0cc3b9fe0452f78a58192877ba09f4edab5bfc5d0dfb5b3c467cc23a323def408d0b8342c9e40f93abab24fca7f9d7f0860f98a5d6ef80f56ba46b729bb9c2c495a0a8485318920cbbb145c67c62058137e166dc4c966b11448c8b7d7373f2b83fa6faf7fe4f5f8a530828aed99f7c39993f789305aeac6aad55a956fb779b8f4c67f9639e3dceaeafd41da4d1d99c34613f75ab4a4fd8af65c6bc0ff17e2e9e5ebb64be04979c105914c51b142e45cbb17d2694251f2beef0fd0078210fb1f949dcda554fbd8af98ef08536083ce5068b31b3cdaeb2aac86178f8ef2ae2b3195b658916daf6f93a0bc5deff8a38ef0d150572f23d3da35a9908c87ce9fee7305ccf6f3b5b581a11f0afd822d0c53e6b1abb7e8f350922161b29258541635e0acb5a280e2eba998ae73b30f883e1b6ff5adbf1e6a2e8a9d3b5de1b6f2484b4925547d06f3b0ce9aece9212d7f6dcd6b9ca3c73ff172a3fbf85ed523a2460854ca4c17fc286d3634c533f6018585513e598c8336e1d3153cccea0d8c9b1e4b162a9c18fa84d8eb5f87e70db2fd1adb8e8e442f19e3fdfa7d953a999f2a98773981a134b813bf6178d86ba69d4dece4d1c3224864c636c285c4f468ddb1307cf15d654d360f3b1baa3351750c4a1acd71a35fbfa224ed0b566d7315107fb57864f1b1ca51816210b7e06da5910218fd8cf6e5e9eddacc35616dd7687a4305c3c5fa94b50133ba47e8e9ac0cf1217fc3364c374de467807e3b7c1ccf31fe6a923d59f0ad38396c0afcadd386eb652bc2138ce113d1006ba26c5679875508f9ac3a386ebbd1491f9ac485348e6ce01d665749c4878ac2becbfdfa23dd5bd784959e38d742a88521eb487d8be650c34194e3098912e7dcdd20fa9b91569a2463795a0f11c1afd522cc4ff67f3ad80c399d5476232676697ce7411acd9f366e994725e898c8b44b6c1ec639a99701654af08ab7970ff8827a7176c1a0237ed48d1867cb32d2c748bb2f67b6477e5576a8f4168475ef7d90f901c57f8ee7e4c3c4d2c13822f5f88501d8f654ae4e632d1979bf77e80b7ef57fed06144c2da5a8e401e377ac31c936548d3bf2b92919bc28617fddccfdf752257836f8b9b48f021d9e58d419dda2df4030172b846f30b4cdbbfaf0742d8724641990143d61789a905c58cae572808070ff4329b46880f897e97e8a909ddea42455445512bc5d0bcf916c2440b73d3f435feb08f8a60a682b6b4749f0bf36f818424cfb0fe33a67f9224199ab09f4d38576cf6e4fa1dfd840d36e07ce302cde5fc008acd8352d205883c2a9f42a1a273717d42a3bfa1fa33b05e3c8b0d8ba27ee6817250fcd39486e9ebbd7cf943865b8ae36a9b8a1a80425cc71f44f69b39a5df8fb51c4d31a73c2bf1eb39d4f73567b5989ad8d40e4ff9f526005673bd9f6807f6e31ed4e78fba452fb61aca11f3e57f8c672bbe97b928db6c505c011f700f8da522f5a96db4a391abfe52a030d336dd0ac886dc5ffa9cf8f42b793bc018feb979e8a4194efe62d31adacbbc5aeea341bfafdb9ce6390971d533eb3d24d4db6d16c1b912eac85bc5de4134092d199eb0d3ef16204deddcf06dda471241fbdbe7fdb08d82aa575fa68c438f728f9a20215f01f81fb48662a0daf22ac7c0a6076f2cd48f6a5aad8857a0cddc3a07a4c7924453d3b44164a87b0cc87317eecd8f33512f80897d2a439d93dba0b585ddb1237e6a20b60917bdc52a844e9b7701586b34ac8ff52c60c7d80db83b6ff3ed667adef7b8b9de05411173541d914b8f03dbd73574dc3ae7e46c43bf9ce1c87451447b817c8efb4c3ec2e0a9370a5239ab0cdb9669539bd08aaf582f7d78759b32f5f9099aeb00d843e4f9e14d4a893073433503a6f5288c37c91c764ad8c410368e1eb4cd9a4c2085feca996b83abb2dd83a2f462b5e7748927a95006f7d08a1dbf1c42544abead5e73c3ab11038e5f7122205f7a5f207fb7c27daf781130460eed5aa607808de7231f55939657e4d5dbc93292d80f995d9c283d894952dfd7a5fb91b82b1769e41c203059c7ba1449fa1bd7958f99850e5dbf4d40d3e6ebe3038df3e0b9e13fffd1080232e7a4250761e5e32f68646c88a9e1eec544edd8af68c5521996adf2a07dfec87aab3e2de9d96705ac7b0b8be39d7d4c0296cf43bf00812e8ae516c67ea83298debd1894375ae2c6cc8e402372362a706d927a90bdc48e67671083d3de3d41be9d1618b21b7ab2bb1556dc824d0435d023b6448fe0f60bee0dd7b53512715dc972ea08682c282d612d99a52a0665b5a4d5638d87912259eacea2fa6f004fe57805511677d017b2d201fbc20f624efa62164b41e6b53c7beaa72bca49cd78abedf6eb383a2eff88c60ebf567ee0ba4dfa215fe13698179b690e3fbe38a2cf615c18b67e27bb34ccbd4adb05dfb5a9ea716452f4c3b30acdfafdc5dd7761febb99845315e2b7caf14e716354389fa66d4b81a5673e5538b0e7db3f1cfacf2984e4099d0593e01e85a9d173e14b8af82ebc94a4a2e2e57c2dcad950cc70345eaa45bf1a859cc2e251a0af1452410a0c4c1e499432f6455ad94ce7828757e14760aecef9098be918f93ae76c4cf49bb63b09f9fd19f6289649ba63df24e1c35e7799fdc4f1c393ccdd4152da129d298ec50d6664a27cc97093aeedbc84f158c9565edbefb5b7229e0df054224ecaf9bf9804f58dc6a1aac610cc6cecfcaa434748dbbf50d4825a08618f919c44567186851228dfaf5860bd0e3d83990b7704df84d755b4fb94141bca9fcbc42732c1ca78b163109708356a410f119599b33e296d858277e14434e52b1d754ce64d3f247c6b0195836be1a525a745f1e13b6bbefbf0e1d99a3d1a1e6b53bfdad86a86f7670e2d5c6cdd49dbb04dc4e8ddc557bb3878844ec8ecdd0153c35a72e5cacdf39beb19a606689050e6425a80545212021e7ef5edb94a583b3df8a55bff0001d32625e3acd1b8e4be6b02c1856eed629a8eb5a5282af3df9f9be6257f6b087f409a8a30bd08b0d414eb5836799091456c17a3ca7ef8e9d7bc37603d2de007278339b3f15670638bb0f57510d7f62d084b7e352b0e4fe21c6d712613497f39ae89177c91f3e0b57865e66f5746d166d7cf50080c3147cb708e1e3bd738b301ecba845a3ad34c8cc67df68942c6232772a7428e027988671fe84c530ae394fbf2288b83d0c45e9670b0cfd2493f86b3b5eb02734649cfb25b6a6b3456ac70d1f5a9a92d50c3102254b57779837e137b39f8537fc4ab7418020698fb28cac8837f322cacdb89128bf7ab0c418927fa47c9899d104e3f88be33819f57a5bec8e3f87f5d90246d2c0e7309131927c246be3986b72fb2f930b1c77a584c76b2d0e9e59157235a481b107ffd6a6546f1ef9f6729965994b649dba325b58a7c88baaaad817a6137fd654e34a0f92ef2b485c14e8831f8bcfad2698c74ebecd15ddc91e343456832350468786617d4f5482b42981613053193c7747255a7394979e40ae59cdcb66cbeae013c142cfbe85c2a1bcb43195049f09a7f1ac46e4abb81912ce71abc380bd91b232d20b4a94ff78de8434b043ae4a546b89ee230617e9d95f83a4b0d3b42e592207f69a7fecd521375a17a80fee24c67243e1f45433daaa0d545a2b9b6905ba3b9825315aa90b28df6acecc7af14bccd476122b8718e7f65297c35e49eb5d19b7a636938e55996ea3492f4703f79be9a461cde5cc2f4002cddb59094e48c2fd67a8d87b82d25448828952e09eb722334e811c3b0b4e82cbcbd930314bfff9b2eea3c8968101ac0daccbcbc00705ee137cd797299ae7ae1c497a464ae25a58ea3b727e777bd72404b4f3c61f8fa905d38d408044c4d546050aa83329043c24a549b896daddda2ea0b29670d309725559875bd63846a29c86341af04f70aa6ca54162010498f22a1be9968554fd7465bbb3790ae46c7f2bf313c616ab7a63ec56acf2e755187a84ff46dc78a43096c8ab112ae9d957f378063f03025d4bbc22ec93da234a8880950d2238c8820cc2018b2b3a1cea6109e25be802f3860a87373434df830f4f1b105232b047ea93ae87593f6e4ce9d8f81ca68efde4c11c10289e0fefb99000000000000000210100000800000076ab1cae56484af2c831e0549ecd2748647202352ff8859527bdbe11dcee3a4d34c1a5c24dd7aefaac68c8bc160b1affe1e6b94612ee6307b217023fe60432a30d083854332ab7da8d16279833f33ffb7c4198c350a1c25f7c13ef82a666d94b8aad17e68949a93dd26b692771ebf99a1d9d10da3f58923d08b1bfd2aed0f40000000000000000000000000074e1677f6a332a9304bc802c97f6b284e7ff3c5a85ddf452ecc37e9f5d7ac60b8850bf2c832338e81b34ac2b351850ca5b1e73b4b761560905950bb35b3463ea34b343a543ce90072cdf44b9fa205c833f61e8e1006884072dc8e2b2e6aa559587f6c72c9a20ab8995a5781b"], 0x10a0}, 0x20000005) write(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="000600"/12], 0xc) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt(r5, 0x65, 0x1, &(0x7f0000000080), 0x1d0) bind$can_raw(r5, &(0x7f0000000000), 0x10) close(r5) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x2, &(0x7f0000000080)=0x27e, 0x4) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) executing program 3: socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x0, 0xfffffffd) sendmsg$inet6(r0, &(0x7f0000000480)={&(0x7f0000000000)={0xa, 0x4e23, 0x7, @loopback, 0xfffffffa}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000080)="b4f387ab6bbb09affa37a9b31d908d94", 0x10}, {&(0x7f00000000c0)="a07266c4c866b211bdcca2b57efe329389798549016c640f3c46d296d4be637823fa4970dfe780640233928e761239d0ecc7368d2170d5f1db605beccfc5a33ba703dd5ae47de1b99b87cfd2390e6342aac4e6b0ee998b0d82897ed2535c5ea726d28799157ffdb905d94c96415b4c36e76b44a8c31f382cde3374311006687db3", 0x81}, {&(0x7f0000000180)="a128a221c89decf2ff037466b3c3b5295be22d0d4bd6a1bcb5263ebd18a427691b11b65ae5cb79b1cf58456d0908385d71f2c1064a32179959b250927189eeb85a6dbf9b95c08f80aae7fa89df3a9467fc1cfa520162df50de0a8f77cbad047f5425c7851faa2605b54f454875", 0x6d}, {&(0x7f0000000200)="fd1be0413f05fdc8dc0255c93fdcdf7a74e39af582785c4a074ee60d71b31d7b8e9a750b6ba31b69886847d1d9534233087f308f41f907b2f83382a8f334e53f1ed5ee46336c10e4892fd9d4aa13e07f7d41835392dc8be08382535d1794b775067c520e62d4d501feb39de7a70722ec6c2a7b779f7f7ab7ff218df8e5fc13f8ff65af45f859516c46a6f6c8090669f188ba4ae0c4cae9", 0x97}, {&(0x7f00000002c0)="89f3f3d888a5b57307b9bad71f9b025e26307af99ea0", 0x16}, {&(0x7f0000000300)="16f32b3bd83f6a07fe29427e6e2c8d8fd5602ebb7282b230f35c980e8d435a73ab9f4b887ee8ef73d903966c7d039f2123f9b9eef563ed6fd0b0b017ac56ba1b2b4fc6b3645ea6f575fc44abc1baff9177066188d4e3a265b27dc1de48cbf4de0f04a9c4b23b5502465676803298cee9fde6a4d0f763017dd9309f9ab4c55706537574782333cd05f263cf04079126fdea6e3bb294cc31b2ccd367edf3e022c9274daf1720987d", 0xa7}], 0x6, &(0x7f0000000440)=[@dontfrag={{0x14, 0x29, 0x3e, 0x80}}, @flowinfo={{0x14, 0x29, 0xb, 0x200}}], 0x30}, 0x401) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0xba57, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x12, 0x4, 0x8, 0x8}, 0x48) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x13, r1, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r2, 0x0, 0x3, &(0x7f0000000000)=""/82, &(0x7f0000000080)=0x52) executing program 3: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x10, 0x2, 0xaa4f}, 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYRES8=r0], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="1800000076000907000000000000000007020200f80b708d22834f7eb535f9e7e948396df783e8f33d5032321abd84386a5ed2f15058c4f6b9b769b50ad8faa70fb30bd4e232f5a120c86b32ba3d5d4e3aa40500000068ec7c3cf73e3dd0637fc849fe5f73cc9f6e390f9e8734001b51c91b21b0b0cba43193f74f9a76898024f1af413e3e402654bcadcf9af83f52793b06a90253da45d6b5b896faf0eced83ba0eccddeea38958df88eb", @ANYRES32=0x0], 0x18}, 0x1, 0x5502000000000000}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bpf$ENABLE_STATS(0x20, &(0x7f0000000440), 0x4) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000040)={'wg1\x00', 0x0}) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000200), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000080)={&(0x7f0000000a40)="63d719522ba00183ec370649c931f93760f1e666a84b2480471c4ba34f41bb74a766ec3cd3ff36fdeb54ebd1ad58d03607fa1aa399a143be1ccd298cdd6ff1accaf2577b724f9110c7ebcbb1232152d5eebfafca9b1d1b301abd8032d12e826ba59b453ee90488f7cf0914394387a8e1dc47d9d92bcda1d25aac2aff2c8d7e8ee1c41f4788293ae69b7a29505071", &(0x7f0000000b00)=""/242, &(0x7f0000000c00)="73f9ddf78f5d3ad4933d69cdc49b3917c9ec6dd025b664732b31045f1bb8f70b463c087512724b578daf0596915baa3f327ed693368ba6b6928d86ff7ad599091d01fd74a050288826ed6bcd4f16fbff89b72e3e9336362aa426d5ae8bae8a461055f84105f6151a3803cb292569cc3d3623a2a3fdfc1d3aff1a19edb1edf3d155e0a6cafe9c5fc1f3", &(0x7f0000000cc0)="d00a202d82e01adf07f38cff3c7e95179ed439b5f243e6b27980f855868d248f39899b8abbf5d9d7483cb816e6c649565c19d0e637ebdd991c1ac71f8f6956da84ca1b4a947ced0ee2e3dd68bd5f549cc743bf26f547d1bacb6eae142f6724cdde786e48e6b661ee1a57f0e8f86afcab0cfdd9e44c185f07efcf1698bbfd73809d1dd91819d3d59cddbe0475a5b52148cbe70c0d934ac0f4cd3a464153f059373a4025a797e6ce44b3dcd5a7ea129ec369643414ee12a9ae92625b85dbeb3f251a0e1e5f41", 0x3}, 0x38) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)={0x4c, r10, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_FRAME={0x30, 0x33, @deauth={{{}, {}, @device_b}, 0x0, @val={0x8c, 0x10, {0x0, "0262c80200", @short="094c1f2501e02962"}}}}]}, 0x4c}}, 0x0) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r7, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={&(0x7f00000008c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="300029bd7000fedbdf255300000008000300", @ANYRES32=r11, @ANYBLOB="4c9222b8c19f7da62a060a5b2ead62acbf69050083f83b3649dd1c848fcdecea39f55df3793797e0d4fb844cf52fc2c4d254d3490def7f77e3a8c472b0e2951d7d0efde1b701c45b7adb2ce736cbb9e2844824b57b571cb8a9e6f4699983673ff352f5242ab5b6edae43bce347ecdeeb24f9c93ed0f5740de0f9496f511881ab93df5a460de0cc59edc2126a3d89c32cdb7a6c6f4715cf1dfdbea3cc6cc5b9527cb17e04edb9496619a3e5999a9148318f3c68d3d570c953b43de0312ef207b164aae1011a8b1f7a29275e6dc8e1df48222b70ad2df44b36e6d57be4b2870a901e9950c632088b00a2d81bbfdb93a479716a1fbb677729638b8d61c4013579619dcfd1fd21491601772f2ff23211ab5ae1cca9e10c7746f178b5bda08bb6cf7e02d9069d4361073dc1e5c745de3d39a5d6b0c9e64737d97a7b8ef63b80946dd59e8ac330b099"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r12, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)={0x104, r6, 0x405, 0x0, 0x0, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r5}, @WGDEVICE_A_PEERS={0xbc, 0x8, 0x0, 0x1, [{0xffffff9c, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "5577e9880050c7f502e96f1152ac2aa4cd9a9de7aa3f159b65412d9b8c39cac4"}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x0, @local}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x0, 0x0, @local}}, @WGPEER_A_FLAGS={0x8}, @WGPEER_A_PUBLIC_KEY={0x24}]}]}, @WGDEVICE_A_LISTEN_PORT={0x6}]}, 0x104}}, 0x0) getsockopt$rose(r3, 0x104, 0x6, 0x0, &(0x7f00000002c0)) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x3, &(0x7f0000000580)=@framed, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r13, 0x0, 0x8, 0x7, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_route(0x10, 0x3, 0x0) r14 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r15 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r15, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x18, 0x30, 0x1, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x290, 0x0, 0x150, 0x150, 0xd0, 0x90a, 0x1c0, 0x238, 0x238, 0x1c0, 0x238, 0xf, 0x0, {[{{@uncond, 0x500, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x8}}}}, {{@ipv6={@remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'dvmrp0\x00', 'netpci0\x00'}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f0) executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet(0x2, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000)=0x100, 0x4) recvmmsg(r0, &(0x7f00000021c0), 0x5b, 0x40, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0x40305839, &(0x7f0000000000)=ANY=[]) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={0xffffffffffffffff, 0xe0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000001c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x9, &(0x7f00000006c0)=[0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2b, &(0x7f0000000540)=[{}, {}], 0x10, 0x10, &(0x7f0000000580), &(0x7f00000005c0), 0x8, 0xdd, 0x8, 0x8, &(0x7f0000000600)}}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f0000000840)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x125, 0x125, 0x8, [@union={0xb, 0x7, 0x0, 0x5, 0x1, 0x4, [{0x9, 0x0, 0x4}, {0xf, 0x3, 0x1}, {0x8, 0x0, 0xd03}, {0xd, 0x0, 0x5}, {0xc, 0x2, 0x4e5b}, {0x1, 0x0, 0x4}, {0xa, 0x5, 0x3d}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x4, 0x4}}, @const={0xb}, @union={0x9, 0x6, 0x0, 0x5, 0x0, 0x1ff, [{0x7, 0x3, 0x2}, {0xe, 0x3, 0x2001}, {0x8, 0x2, 0x3ae}, {0x3, 0x0, 0x7}, {0xe, 0x1f, 0xa0d}, {0x9, 0x5, 0x4}]}, @restrict={0x2, 0x0, 0x0, 0xb, 0x2}, @datasec={0x10, 0x3, 0x0, 0xf, 0x1, [{0x5}, {0x1, 0x101, 0x7ff}, {0x100001, 0x24, 0x7ff}], '9'}, @int={0xc, 0x0, 0x0, 0x1, 0x0, 0x34, 0x0, 0x23, 0x1}]}, {0x0, [0x5f, 0x30, 0x61, 0x61, 0x61, 0x6f]}}, &(0x7f00000009c0)=""/225, 0x148, 0xe1, 0x1, 0x1}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="27ae000000000000b7080000000000007b8af8ff03000000bfa2000000000000f8ffffffb703000008000000b704000000000000850000000100000018010000786c6c2500000000002020207b1af8ff00000000bfa100000004000007010000f8ffffffb702000008000000b703000000000000850000000f0000009500000000"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r1, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001680)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r2, 0x400454c9, 0xba98575a95aeb70d) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000580)="e02742e8680d85292c00002f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000180)={@broadcast, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [@hopopts={0x2c}]}}}}}}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="0000000065a1f587b21600004acae67f2cd3dab53ac5652a641f2161d6e2d7aba3998d50ca29560971e15a74b13b2b5d32d9dd6c490eb101a472ad38ebba3c6317279abdd1039cd09e939ac1d2b6a20ff528bc104b3d86dd5b3398943dbb39f8cb241faf647cfaac5c786915e64dbd2cdf113975821fda0d8a4ba65a3a400959eace3f6b8a9cf88c9c98336c571ed6a4bfc10379912114fd3bc54d5df43338c0b0dfb3063cc1c548e422771836b02cdac693379b69073c70204dd00d11d51e73d4fdf8d135e3be5d31015a094ad23a1d5f49d55d5a73ec2c271227a872d4c6b98282cacc9536e43957da4588b05b019ead0a3d76ed25250ca1effd4caed7f692", @ANYRES16=r3, @ANYBLOB="100028bd7000fbdbdf250800000020000380060007004e2300001400020076657468305f6d61637674617000000008000500ff070000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x8001) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r5}, 0x4) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x1a0, 0x1a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x0, 0x10000000}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x13, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff000083a6340c715774ff000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000d0e94ad9ece636246f4b41126f85c29d0da327ad3f4c197b14548adf16c32bec8da20c5fb3fc073205c21edab3765d5e73aca6bd930d0346d217a7b9f38aad2a35d636f99f103b24917b3b4da2e0b341b64e32a6ce8ce8b1b30b4b0db865bd8766e52796", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000a00000085000000a50000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r4) close(0xffffffffffffffff) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r7, &(0x7f0000000000)={0x20000010}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r1, 0x1a0a5000) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair(0x11, 0x3, 0x102, &(0x7f00000007c0)) sendto$inet6(r8, &(0x7f0000000100)='b', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000640)=[@in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x3, @remote, 0x3}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x7, @loopback, 0xff}, @in6={0xa, 0x4e21, 0x2, @empty, 0x6}, @in6={0xa, 0x4e24, 0x3f, @loopback, 0xe8d}], 0x9c) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x17, 0x3, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x60}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}, @IFLA_MTU={0x8, 0x4, 0x40000500}]}, 0x50}}, 0x0) executing program 2: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000900)=""/221, 0xdd}, {&(0x7f0000000d00)=""/249, 0xf9}, {&(0x7f0000002140)=""/4043, 0xfcb}, {&(0x7f0000000a00)=""/235, 0xeb}, {&(0x7f00000007c0)=""/182, 0xb6}, {&(0x7f0000000b00)=""/211, 0xd3}, {&(0x7f0000000600)=""/179, 0xb3}, {&(0x7f0000000cc0)=""/59, 0x3b}], 0x8}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=@framed, &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="25003300d0000000080211000001080211000000505050505050000003"], 0x44}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x0, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="61155000000000006113500000000000bfa000000000000007000000ee0016055e03010000000000250500000000000069163e0000000000bf07000000000000260507000fff0720670600003f000000140300000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871"], 0x0}, 0x90) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @union={0x0, 0x0, 0x0, 0xb, 0x0, 0x2}]}}, 0x0, 0x4e}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000002c0)="b9ff03076003008cb89e08f086dd", 0x0, 0x0, 0x60000000, 0x0, 0xfffffffffffffce7, 0x0, 0x0}, 0x50) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) socket(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x7c, 0x10, 0x421, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x0, 0x61}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x4}, @IFLA_GRE_OKEY={0x8, 0x5, 0xda4b}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e21}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x1}, @IFLA_GRE_ENCAP_DPORT={0x6}]}}}, @IFLA_LINK={0x8}, @IFLA_MASTER={0x8}, @IFLA_ADDRESS={0xa, 0x1, @dev}]}, 0x7c}}, 0x0) write$binfmt_misc(r5, &(0x7f0000000200)=ANY=[@ANYBLOB="4900030007"], 0xd) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x61}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r8, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r3, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x1}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4040814}, 0x48001) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b05d25a806c8c6f94f90424fc601000127a0a000612073582c137153e37080c18800bac0f000300", 0x33fe0}], 0x1, 0x0, 0x0, 0x8100000}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r9 = socket$netlink(0x10, 0x3, 0x4) writev(r9, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) executing program 4: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan0\x00', 0x0}) bind$can_raw(0xffffffffffffffff, &(0x7f0000000240)={0x1d, r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0xfea7) sendfile(r0, r2, &(0x7f0000000000), 0x11) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="5e873a1800"/14], &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) executing program 1: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ff00ff85000000040000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$phonet(0x23, 0x2, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002e00)=ANY=[@ANYBLOB], 0x108}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010200000000000000000000000a70000000060a0904000000000000000002000000440004802c0001800e000100696d6d656469617465000000180002800c00028005000100c4000000080001400000000914000180090001006861736800000000040002800900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x98}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'vlan0\x00', 0x0}) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000080)=0xf3e, 0x62) sendto$packet(r2, &(0x7f00000000c0)="3f033608260812002c001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c56090", 0x3b, 0x0, &(0x7f0000000540)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001600)=ANY=[@ANYBLOB="1c0000002a000921bb5a8fffff0000000400002c24101a8004000400"], 0x1c}, 0x1, 0x3000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffff2) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r7, &(0x7f0000000000), 0x6e000) executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r2, 0x111, 0x2, 0x0, 0x20000000) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x350, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0x100, 0x128, 0x0, {}, [@common=@inet=@tcp={{0x30}}, @common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) executing program 2: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000180)={@broadcast, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [@hopopts={0x2c}]}}}}}}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="0000000065a1f587b21600004acae67f2cd3dab53ac5652a641f2161d6e2d7aba3998d50ca29560971e15a74b13b2b5d32d9dd6c490eb101a472ad38ebba3c6317279abdd1039cd09e939ac1d2b6a20ff528bc104b3d86dd5b3398943dbb39f8cb241faf647cfaac5c786915e64dbd2cdf113975821fda0d8a4ba65a3a400959eace3f6b8a9cf88c9c98336c571ed6a4bfc10379912114fd3bc54d5df43338c0b0dfb3063cc1c548e422771836b02cdac693379b69073c70204dd00d11d51e73d4fdf8d135e3be5d31015a094ad23a1d5f49d55d5a73ec2c271227a872d4c6b98282cacc9536e43957da4588b05b019ead0a3d76ed25250ca1effd4caed7f692", @ANYRES16=r3, @ANYBLOB="100028bd7000fbdbdf250800000020000380060007004e2300001400020076657468305f6d61637674617000000008000500ff070000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x8001) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r6}, 0x4) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x1a0, 0x1a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x0, 0x10000000}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x13, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff000083a6340c715774ff000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000d0e94ad9ece636246f4b41126f85c29d0da327ad3f4c197b14548adf16c32bec8da20c5fb3fc073205c21edab3765d5e73aca6bd930d0346d217a7b9f38aad2a35d636f99f103b24917b3b4da2e0b341b64e32a6ce8ce8b1b30b4b0db865bd8766e52796", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000a00000085000000a50000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r4) close(r5) socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000010}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r1, 0x1a0a5000) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair(0x11, 0x3, 0x102, &(0x7f00000007c0)) sendto$inet6(r8, &(0x7f0000000100)='b', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000640)=[@in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x3, @remote, 0x3}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x7, @loopback, 0xff}, @in6={0xa, 0x4e21, 0x2, @empty, 0x6}, @in6={0xa, 0x4e24, 0x3f, @loopback, 0xe8d}], 0x9c) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x17, 0x3, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x60}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}, @IFLA_MTU={0x8, 0x4, 0x40000500}]}, 0x50}}, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket-syz_emit_ethernet-syz_init_net_socket$llc-socket$nl_generic-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_GET_DEST-pipe-bpf$MAP_CREATE_CONST_STR-bpf$BPF_MAP_CONST_STR_FREEZE-socket$inet_icmp_raw-setsockopt$IPT_SO_SET_REPLACE-bpf$PROG_LOAD-close-close-socket$inet6_udplite-epoll_ctl$EPOLL_CTL_ADD-mmap-socket$inet6_sctp-socketpair-sendto$inet6-setsockopt$inet_sctp6_SCTP_INITMSG-setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD-ioctl$EXT4_IOC_SWAP_BOOT-socket$nl_netfilter-bpf$PROG_LOAD_XDP-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bind$llc-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000180)={@broadcast, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [@hopopts={0x2c}]}}}}}}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="0000000065a1f587b21600004acae67f2cd3dab53ac5652a641f2161d6e2d7aba3998d50ca29560971e15a74b13b2b5d32d9dd6c490eb101a472ad38ebba3c6317279abdd1039cd09e939ac1d2b6a20ff528bc104b3d86dd5b3398943dbb39f8cb241faf647cfaac5c786915e64dbd2cdf113975821fda0d8a4ba65a3a400959eace3f6b8a9cf88c9c98336c571ed6a4bfc10379912114fd3bc54d5df43338c0b0dfb3063cc1c548e422771836b02cdac693379b69073c70204dd00d11d51e73d4fdf8d135e3be5d31015a094ad23a1d5f49d55d5a73ec2c271227a872d4c6b98282cacc9536e43957da4588b05b019ead0a3d76ed25250ca1effd4caed7f692", @ANYRES16=r3, @ANYBLOB="100028bd7000fbdbdf250800000020000380060007004e2300001400020076657468305f6d61637674617000000008000500ff070000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x8001) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r6}, 0x4) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x1a0, 0x1a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x0, 0x10000000}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x13, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff000083a6340c715774ff000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000d0e94ad9ece636246f4b41126f85c29d0da327ad3f4c197b14548adf16c32bec8da20c5fb3fc073205c21edab3765d5e73aca6bd930d0346d217a7b9f38aad2a35d636f99f103b24917b3b4da2e0b341b64e32a6ce8ce8b1b30b4b0db865bd8766e52796", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000a00000085000000a50000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r4) close(r5) socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000010}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r1, 0x1a0a5000) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair(0x11, 0x3, 0x102, &(0x7f00000007c0)) sendto$inet6(r8, &(0x7f0000000100)='b', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000640)=[@in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x3, @remote, 0x3}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x7, @loopback, 0xff}, @in6={0xa, 0x4e21, 0x2, @empty, 0x6}, @in6={0xa, 0x4e24, 0x3f, @loopback, 0xe8d}], 0x9c) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x17, 0x3, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x60}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}, @IFLA_MTU={0x8, 0x4, 0x40000500}]}, 0x50}}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_freezer_state-write$binfmt_misc-socket$nl_route-socketpair$unix-ioctl$int_in-connect$unix-sendmmsg$unix-recvmmsg-epoll_create1-epoll_ctl$EPOLL_CTL_ADD-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-setsockopt$bt_BT_DEFER_SETUP-socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$PROG_LOAD-sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS-epoll_pwait detailed listing: executing program 0: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-sendmsg$inet-recvmsg$kcm-openat$tun-ioctl$TUNSETIFF-socket$kcm-socket$inet6_sctp-socket$inet6_udplite-socket-socketpair$unix-bpf$ITER_CREATE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$l2tp6-setsockopt$IP6T_SO_SET_REPLACE-openat$cgroup_ro-openat$cgroup_ro-socket$nl_route-ioctl$sock_SIOCGIFINDEX_80211-ioctl-ioctl$SIOCSIFHWADDR-recvmsg$kcm-openat$cgroup_ro detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x350, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0x100, 0x128, 0x0, {}, [@common=@inet=@tcp={{0x30}}, @common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_freezer_state-write$binfmt_misc-socket$nl_route-socketpair$unix-ioctl$int_in-connect$unix-sendmmsg$unix-recvmmsg-epoll_create1-epoll_ctl$EPOLL_CTL_ADD-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-setsockopt$bt_BT_DEFER_SETUP-socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$PROG_LOAD-sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS-epoll_pwait detailed listing: executing program 0: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$packet-mkdirat$cgroup_root-openat$cgroup_root-openat$cgroup_freezer_state-write$binfmt_misc-socket$nl_route-socketpair$unix-ioctl$int_in-connect$unix-sendmmsg$unix-recvmmsg-epoll_create1-epoll_ctl$EPOLL_CTL_ADD-syz_init_net_socket$bt_l2cap-bind$bt_l2cap-setsockopt$bt_BT_DEFER_SETUP-socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$MAP_CREATE-socket$inet_icmp_raw-bpf$PROG_LOAD-sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS-epoll_pwait detailed listing: executing program 0: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x10, 0x2, 0xaa4f}, 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) program did not crash single: failed to extract reproducer bisect: bisecting 24 programs with base timeout 1m40s testing program (duration=1m46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 19, 20, 23, 30, 5, 19, 12, 8, 26, 13, 24, 30, 18, 30, 30, 6, 26, 21, 19, 13, 26, 22, 30] detailed listing: executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509", 0x4e}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000900)=""/221, 0xdd}, {&(0x7f0000000d00)=""/249, 0xf9}, {&(0x7f0000002140)=""/4043, 0xfcb}, {&(0x7f0000000a00)=""/235, 0xeb}, {&(0x7f00000007c0)=""/182, 0xb6}, {&(0x7f0000000b00)=""/211, 0xd3}, {&(0x7f0000000600)=""/179, 0xb3}, {&(0x7f0000000cc0)=""/59, 0x3b}], 0x8}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=@framed, &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="25003300d0000000080211000001080211000000505050505050000003"], 0x44}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x0, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="61155000000000006113500000000000bfa000000000000007000000ee0016055e03010000000000250500000000000069163e0000000000bf07000000000000260507000fff0720670600003f000000140300000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871"], 0x0}, 0x90) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @union={0x0, 0x0, 0x0, 0xb, 0x0, 0x2}]}}, 0x0, 0x4e}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000002c0)="b9ff03076003008cb89e08f086dd", 0x0, 0x0, 0x60000000, 0x0, 0xfffffffffffffce7, 0x0, 0x0}, 0x50) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) socket(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x7c, 0x10, 0x421, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x0, 0x61}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x4}, @IFLA_GRE_OKEY={0x8, 0x5, 0xda4b}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e21}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x1}, @IFLA_GRE_ENCAP_DPORT={0x6}]}}}, @IFLA_LINK={0x8}, @IFLA_MASTER={0x8}, @IFLA_ADDRESS={0xa, 0x1, @dev}]}, 0x7c}}, 0x0) write$binfmt_misc(r5, &(0x7f0000000200)=ANY=[@ANYBLOB="4900030007"], 0xd) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x61}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r8, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r3, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x1}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4040814}, 0x48001) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b05d25a806c8c6f94f90424fc601000127a0a000612073582c137153e37080c18800bac0f000300", 0x33fe0}], 0x1, 0x0, 0x0, 0x8100000}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r9 = socket$netlink(0x10, 0x3, 0x4) writev(r9, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) executing program 3: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ff00ff85000000040000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$phonet(0x23, 0x2, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002e00)=ANY=[@ANYBLOB], 0x108}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'vlan0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x0, &(0x7f0000000080)=0xf3e, 0x62) sendto$packet(r2, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001600)=ANY=[@ANYBLOB="1c0000002a000921bb5a8fffff0000000400002c24101a8004000400"], 0x1c}, 0x1, 0x3000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffff2) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r6, &(0x7f0000000000), 0x6e000) executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000700)={'wlan1\x00'}) r2 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f0000000200)) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f0000000300)='sched_switch\x00', r4}, 0x10) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r3, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) socket$inet_sctp(0x2, 0x1, 0x84) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000040)={0x6, 'veth1_vlan\x00'}) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="f49362e343d7bd021e836690d26fa3c6080ad7bdcdc761326a3cdacff5445e0647e0925ad774247ae4d46ec34e167e7405e12e8b647c6f332c28d0a2c7eee22fbd6109992217733fa73cd8054ceef50b970861f66c2ec1fc6387ea048eab4357ba3d49727417c5ef893561447974fa07872377fd3f779b708de11b692a641d6b9ee3f711f5fc01e6cce6c933eb55fb09faf5f5e7980dda35609630ff8a04397f0d852b6daa1061287a65"], &(0x7f0000000000), 0xab, 0x0, 0xfffffffc, 0xfffffff9}, 0x20) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$pppl2tp(0x18, 0x1, 0x1) r7 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r6, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r7, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r5, 0x111, 0x2, 0x0, 0x20000000) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18020000fcffffff060000000000000085000000417d0000009500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xa, 0x4, 0xfff, 0xc36}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{r2}, 0x0, 0x0}, 0x20) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={0xffffffffffffffff, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) recvmsg(r1, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'bridge0\x00', 0x0}) pipe(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(0xffffffffffffffff, 0x0, 0xfffffd88) bpf$BPF_GET_PROG_INFO(0xf, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r3, 0x0, r5, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2b04a862}, 0x90) sendmsg$nl_route(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000bc0)=ANY=[@ANYBLOB="a40000001e00431b2bbd70000000000007000000"], 0xa4}}, 0x0) r6 = openat$cgroup_ro(r4, &(0x7f0000000440)='net_prio.prioidx\x00', 0x0, 0x0) getpeername$packet(r6, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000740)=0x14) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000004780)={'syz_tun\x00', &(0x7f0000000040)=@ethtool_link_settings={0x2}}) socket$kcm(0x10, 0x400000002, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x22, &(0x7f0000000000)=0x1, 0x4) executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYRES8=r0], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="1800000076000907000000000000000007020200f80b708d22834f7eb535f9e7e948396df783e8f33d5032321abd84386a5ed2f15058c4f6b9b769b50ad8faa70fb30bd4e232f5a120c86b32ba3d5d4e3aa40500000068ec7c3cf73e3dd0637fc849fe5f73cc9f6e390f9e8734001b51c91b21b0b0cba43193f74f9a76898024f1af413e3e402654bcadcf9af83f52793b06a90253da45d6b5b896faf0eced83ba0eccddeea3", @ANYRES32=0x0], 0x18}, 0x1, 0x5502000000000000}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bpf$ENABLE_STATS(0x20, &(0x7f0000000440), 0x4) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000040)={'wg1\x00', 0x0}) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000200), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000080)={&(0x7f0000000a40)="63d719522ba00183ec370649c931f93760f1e666a84b2480471c4ba34f41bb74a766ec3cd3ff36fdeb54ebd1ad58d03607fa1aa399a143be1ccd298cdd6ff1accaf2577b724f9110c7ebcbb1232152d5eebfafca9b1d1b301abd8032d12e826ba59b453ee90488f7cf0914394387a8e1dc47d9d92bcda1d25aac2aff2c8d7e8ee1c41f4788293ae69b7a29505071f9226730fa541946c850ee79fc57444dab17ec3cb12ff3de4920843a514f8a6b98282837966232f38ef7a3af7a26ba", &(0x7f0000000b00)=""/242, &(0x7f0000000c00)="73f9ddf78f5d3ad4933d69cdc49b3917c9ec6dd025b664732b31045f1bb8f70b463c087512724b578daf0596915baa3f327ed693368ba6b6928d86ff7ad599091d01fd74a050288826ed6bcd4f16fbff89b72e3e9336362aa426d5ae8bae8a461055f84105f6151a3803cb292569cc3d3623a2a3fdfc1d3aff1a19edb1edf3d155e0a6cafe9c5fc1f3", &(0x7f0000000cc0)="d00a202d82e01adf07f38cff3c7e95179ed439b5f243e6b27980f855868d248f39899b8abbf5d9d7483cb816e6c649565c19d0e637ebdd991c1ac71f8f6956da84ca1b4a947ced0ee2e3dd68bd5f549cc743bf26f547d1bacb6eae142f6724cdde786e48e6b661ee1a57f0e8f86afcab0cfdd9e44c185f07efcf1698bbfd73809d1dd91819d3d59cddbe0475a5b52148cbe70c0d934ac0f4cd3a464153f059373a4025a797e6ce44b3dcd5a7ea129ec369643414ee12a9ae92625b85dbeb3f251a0e1e5f41", 0x3}, 0x38) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)={0x4c, r10, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_FRAME={0x30, 0x33, @deauth={{{}, {}, @device_b}, 0x0, @val={0x8c, 0x10, {0x0, "0262c80200", @short="094c1f2501e02962"}}}}]}, 0x4c}}, 0x0) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r7, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={&(0x7f00000008c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="300029bd7000fedbdf255300000008000300", @ANYRES32=r11, @ANYBLOB="4c9222b8c19f7da62a060a5b2ead62acbf69050083f83b3649dd1c848fcdecea39f55df3793797e0d4fb844cf52fc2c4d254d3490def7f77e3a8c472b0e2951d7d0efde1b701c45b7adb2ce736cbb9e2844824b57b571cb8a9e6f4699983673ff352f5242ab5b6edae43bce347ecdeeb24f9c93ed0f5740de0f9496f511881ab93df5a460de0cc59edc2126a3d89c32cdb7a6c6f4715cf1dfdbea3cc6cc5b9527cb17e04edb9496619a3e5999a9148318f3c68d3d570c953b43de0312ef207b164aae1011a8b1f7a29275e6dc8e1df48222b70ad2df44b36e6d57be4b2870a901e9950c632088b00a2d81bbfdb93a479716a1fbb677729638b8d61c4013579619dcfd1fd21491601772f2ff23211ab5ae1cca9e10c7746f178b5bda08bb6cf7e02d9069d4361073dc1e5c745de3d39a5d6b0c9e64737d97a7b8ef63b80946dd59e8ac330b099"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r12, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)={0x104, r6, 0x405, 0x0, 0x0, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r5}, @WGDEVICE_A_PEERS={0xbc, 0x8, 0x0, 0x1, [{0xffffff9c, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "5577e9880050c7f502e96f1152ac2aa4cd9a9de7aa3f159b65412d9b8c39cac4"}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x0, @local}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x0, 0x0, @local}}, @WGPEER_A_FLAGS={0x8}, @WGPEER_A_PUBLIC_KEY={0x24}]}]}, @WGDEVICE_A_LISTEN_PORT={0x6}]}, 0x104}}, 0x0) getsockopt$rose(r3, 0x104, 0x6, 0x0, &(0x7f00000002c0)) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x3, &(0x7f0000000580)=@framed, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r13, 0x0, 0x8, 0x7, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_route(0x10, 0x3, 0x0) r14 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r15 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r15, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x18, 0x30, 0x1, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x290, 0x0, 0x150, 0x150, 0xd0, 0x90a, 0x1c0, 0x238, 0x238, 0x1c0, 0x238, 0xf, 0x0, {[{{@uncond, 0x500, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x8}}}}, {{@ipv6={@remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'dvmrp0\x00', 'netpci0\x00'}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f0) executing program 0: r0 = socket$inet_sctp(0x2, 0x5, 0x84) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e22, @empty}, 0x10) listen(r0, 0x1ff) r1 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r1, &(0x7f00000000c0)='}', 0x1, 0x0, &(0x7f00000001c0)={0x2, 0x4e22, @local}, 0x10) executing program 0: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r5}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 1: r0 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r0, 0x0, 0x0) listen(r0, 0x0) r1 = socket$tipc(0x1e, 0x5, 0x0) sendmsg$tipc(r1, &(0x7f0000000240)={&(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x41}}}, 0x10, &(0x7f00000001c0)=[{&(0x7f0000000040)="e0", 0x1}], 0x1}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x90) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000980)='sys_exit\x00', r2}, 0x10) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) listen(r3, 0x0) accept$netrom(r3, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) executing program 3: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e22, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='westwood\x00', 0x9) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, 0x0) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000280)='g', 0x1}], 0x1) executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000200)={r1, 0x1, 0x6}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001fc0)=ANY=[@ANYBLOB="340000001800290200000000000000000200000008000000000000001500098008000000", @ANYRES32=0x0], 0x34}}, 0x0) r3 = socket(0x2, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000180)="759f3906d915ecc50a23ddb13ac813a75bb3f7e54d453e2a5aa757d57d897e1e709679ad8b5abbcf8fb36d", 0x2b, 0x0, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) setsockopt$EBT_SO_SET_ENTRIES(r3, 0xa00000000000000, 0x80, &(0x7f0000000000)=@broute={'broute\x00', 0x20, 0x1, 0x948, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000010000000068000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000b00000000000000000062726964676530000000000000000000626f6e645f736c6176655f3000000000736974300000000000000000000000007465716c3000000000000000000000000000000000000000000000000180c20000000000000000000000b8080000b8080000e8080000616d6f6e670000000000000000000000001b00000000000000000400000000001804000000000000000000000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d00000000fa0100000000000000000000000000000000000000000000000000000000004037118bc35d3037960000000000000000000000000000000000000000000000000000000000001f0000000000000000000000938d5e000000000000558d7a2006c2257800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e4f500000000000000000300020000000000000000006c00000000000000000000000000000000000000000000000000000000000000000000000000892f9284b45f00000000000000000000000000000000a600000000000000000000000040f9ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000080000001567cc0fb18ebd10677f000000000000000000000000b038562daba737bd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c50000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000ce90b91aedadb0c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ce113362da06e0fa83f39b50390000000000000000ed2c14bc1d077b4817d693d02c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000037ff1cf2f8e52e074300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d659920000000000e5c7ffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cbcb951a4f0f3300ebb39c00000000000000000000000000000000000000000000000000000000000000000000000000e70000000000053cbf7eee533b170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff80000ff0f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002292091a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c1a8a95ba6a3ba677371c303b5426300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c81e00"/2079]}, 0x897) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32", 0x8) r4 = accept$alg(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r4, &(0x7f0000000100)={'#! ', '', [], 0xa, "000000000000c93dd4fb1b25"}, 0x10) recvmmsg(r4, &(0x7f000000ec00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000006a40)=[{&(0x7f0000005380)=""/1, 0x1}], 0x1}}], 0x2, 0x0, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000000), 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001f80)={&(0x7f0000000340)=@pppol2tpv3in6={0x18, 0x1, {0x0, r3, 0x0, 0x4, 0x1, 0x2, {0xa, 0x4e20, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xe6}}}, 0x80, &(0x7f0000000e80)=[{&(0x7f00000001c0)}, {&(0x7f0000000440)="c511d616722fef1fa532865fe4ce053e52c5ac69da8cbbddb63e2fb55aed100ca9c4164ddf6c", 0x26}, {&(0x7f0000000e00)="3b31d64484e641d54cdcb728f0de0da32bac2f19b9bfb307e873093a3b19f3af01ef10e933a2f114327e4cdb18e696b360f0911263de124a0d89bd59d93f1662eb225abd1de9", 0x46}], 0x3, &(0x7f00000020c0)=ANY=[@ANYBLOB="10100000000000000d010000afffffffd624a44d730da7adf135eb1533acb970e4d860e0bc2a13901cd6f200e07d647e1c05f7baafaad51196ae8c7fea74aa0708fe9d0338090c309e130afcc3ff8a7ecb5079fcf96749df2bdeea51cb4b0b46cfa65942b1bc53964da55cf68f283ce46f4c2c4f8dd766abf3363a96b5ab38caa850e17152181a37be911716bb9e48869652cc4413789ca3ce53a961267b403c46ab8b9fa4c817449cad41295eb3b9210d2e881747b1d4330f82906792580dd750d98f42868c3e2e9d4e00c5567eabe0728f0b553cab9ceb02d4061ad88eb09ec14681a35a9bb818763c0bdff1d5fee6a3a51aece00efc3d2f5bda010bd83904e6ef426b7390e4d0e9f057b2895fa40c7fb9b61ddc0b5f144f9d1ab3249890561f57f5db7ae27bf3a574cc20624d52ad9aed33280139ceda357bdeffa53814db63647fbb8ea80565206dc7dfbd8b1f144def537e32c031fbcb3119b88a761aa98821a3ff0b1cac9b32f45d1a7233a1a8dfb517179f82ac0a4458761cdb50234433500aa46aa96d4ec14aa37afab47ab68016a6d1bc7ea8c4dba070371e4579147bb00f549c001b22c94ee6631f3e901014165bcbe00cc40219d80cf0dad6b8a5448d674d8d47afb9b4ff1ae0fe5707f8426a655ae7ec4f0603cf4cb27c2e291fa08b5f321b4e82b35d32c426bf0b1410838f4bbff6204821f303f7e8953005b34091b52796a524491c9b89c548460910496ad68341bf6c9bf9dacf6555b50cd32638786924c47e694f8ab60e632687a03f53f9e6f0ad60c7cfbe5a62d3c33de4bffdcc46730fc28c330fbaf461915a6e98814d8c37f9fa0a5799b905f6eb1147eed18a2aa2d60ea50873de0aed758c4e56419287d76cfc68c545847af1643481254433341d973c5cb41a690cca67d00db9dd5712a207aca657cd7b428d05b13eb60b957122367aa22c247f9b160897445f86f7defbf543cddf1de533097b35203850faca170d5c52da7f83ff27156c6e517c57109d6eb902d2cf36d972166ec3968af1fcadb430627e9f721a0526904f9be0c8a6dda7ee267b021c0406ac616d6f55f472d40d64e4cf352d569c4f5213e2c9a8fdd86ad834ccad031c1e561e5ae9d8ac5c0f80ee0aeaf99f25e300967f63328eb515c0af803e55a58e9c14c449e6c0f75482a8c6d704db9d4b38d2a9e189daeaac546f4df1e80d10c5cd9b95415edaedc01c1bc9e3fbaf4c42649af79000a4ee663602eb5d42232703a27dcbaca54b1d0d69535fa2dc9266e6c74311cf6f596d356dec7172d792190f45df4233713999e6baa86dcd131ead38cdad1aff2d0989c732543146d345dc0a1131b21f66028502fba79075c13d385767ab2415d64f689a4cc417a1aa509c5e4f4a59a0be5b21c1b90bbc7a4d754a318dedccefd93d5cad7a56790c02eed690607e3a0c00aa3564a6f9cab77561653b4397bc7584cb21d57f98107dbddb26082c55f596a04916364488248d34e78d0174264e60c54f3294495e86f1d936ab1c540c20360ac264a90497730db3027c649ab12447d83280ed74cbc9badafcc4337c3d86e9723f01805178b96a8c71d3580cd6acdeab345d2e8089b6c3beca14a2f8716e1ec9790e122bb46b3ae7f8318a2a2a1e0bff9f320dbbca1b2f6037f43aaa0528d0cc3b9fe0452f78a58192877ba09f4edab5bfc5d0dfb5b3c467cc23a323def408d0b8342c9e40f93abab24fca7f9d7f0860f98a5d6ef80f56ba46b729bb9c2c495a0a8485318920cbbb145c67c62058137e166dc4c966b11448c8b7d7373f2b83fa6faf7fe4f5f8a530828aed99f7c39993f789305aeac6aad55a956fb779b8f4c67f9639e3dceaeafd41da4d1d99c34613f75ab4a4fd8af65c6bc0ff17e2e9e5ebb64be04979c105914c51b142e45cbb17d2694251f2beef0fd0078210fb1f949dcda554fbd8af98ef08536083ce5068b31b3cdaeb2aac86178f8ef2ae2b3195b658916daf6f93a0bc5deff8a38ef0d150572f23d3da35a9908c87ce9fee7305ccf6f3b5b581a11f0afd822d0c53e6b1abb7e8f350922161b29258541635e0acb5a280e2eba998ae73b30f883e1b6ff5adbf1e6a2e8a9d3b5de1b6f2484b4925547d06f3b0ce9aece9212d7f6dcd6b9ca3c73ff172a3fbf85ed523a2460854ca4c17fc286d3634c533f6018585513e598c8336e1d3153cccea0d8c9b1e4b162a9c18fa84d8eb5f87e70db2fd1adb8e8e442f19e3fdfa7d953a999f2a98773981a134b813bf6178d86ba69d4dece4d1c3224864c636c285c4f468ddb1307cf15d654d360f3b1baa3351750c4a1acd71a35fbfa224ed0b566d7315107fb57864f1b1ca51816210b7e06da5910218fd8cf6e5e9eddacc35616dd7687a4305c3c5fa94b50133ba47e8e9ac0cf1217fc3364c374de467807e3b7c1ccf31fe6a923d59f0ad38396c0afcadd386eb652bc2138ce113d1006ba26c5679875508f9ac3a386ebbd1491f9ac485348e6ce01d665749c4878ac2becbfdfa23dd5bd784959e38d742a88521eb487d8be650c34194e3098912e7dcdd20fa9b91569a2463795a0f11c1afd522cc4ff67f3ad80c399d5476232676697ce7411acd9f366e994725e898c8b44b6c1ec639a99701654af08ab7970ff8827a7176c1a0237ed48d1867cb32d2c748bb2f67b6477e5576a8f4168475ef7d90f901c57f8ee7e4c3c4d2c13822f5f88501d8f654ae4e632d1979bf77e80b7ef57fed06144c2da5a8e401e377ac31c936548d3bf2b92919bc28617fddccfdf752257836f8b9b48f021d9e58d419dda2df4030172b846f30b4cdbbfaf0742d8724641990143d61789a905c58cae572808070ff4329b46880f897e97e8a909ddea42455445512bc5d0bcf916c2440b73d3f435feb08f8a60a682b6b4749f0bf36f818424cfb0fe33a67f9224199ab09f4d38576cf6e4fa1dfd840d36e07ce302cde5fc008acd8352d205883c2a9f42a1a273717d42a3bfa1fa33b05e3c8b0d8ba27ee6817250fcd39486e9ebbd7cf943865b8ae36a9b8a1a80425cc71f44f69b39a5df8fb51c4d31a73c2bf1eb39d4f73567b5989ad8d40e4ff9f526005673bd9f6807f6e31ed4e78fba452fb61aca11f3e57f8c672bbe97b928db6c505c011f700f8da522f5a96db4a391abfe52a030d336dd0ac886dc5ffa9cf8f42b793bc018feb979e8a4194efe62d31adacbbc5aeea341bfafdb9ce6390971d533eb3d24d4db6d16c1b912eac85bc5de4134092d199eb0d3ef16204deddcf06dda471241fbdbe7fdb08d82aa575fa68c438f728f9a20215f01f81fb48662a0daf22ac7c0a6076f2cd48f6a5aad8857a0cddc3a07a4c7924453d3b44164a87b0cc87317eecd8f33512f80897d2a439d93dba0b585ddb1237e6a20b60917bdc52a844e9b7701586b34ac8ff52c60c7d80db83b6ff3ed667adef7b8b9de05411173541d914b8f03dbd73574dc3ae7e46c43bf9ce1c87451447b817c8efb4c3ec2e0a9370a5239ab0cdb9669539bd08aaf582f7d78759b32f5f9099aeb00d843e4f9e14d4a893073433503a6f5288c37c91c764ad8c410368e1eb4cd9a4c2085feca996b83abb2dd83a2f462b5e7748927a95006f7d08a1dbf1c42544abead5e73c3ab11038e5f7122205f7a5f207fb7c27daf781130460eed5aa607808de7231f55939657e4d5dbc93292d80f995d9c283d894952dfd7a5fb91b82b1769e41c203059c7ba1449fa1bd7958f99850e5dbf4d40d3e6ebe3038df3e0b9e13fffd1080232e7a4250761e5e32f68646c88a9e1eec544edd8af68c5521996adf2a07dfec87aab3e2de9d96705ac7b0b8be39d7d4c0296cf43bf00812e8ae516c67ea83298debd1894375ae2c6cc8e402372362a706d927a90bdc48e67671083d3de3d41be9d1618b21b7ab2bb1556dc824d0435d023b6448fe0f60bee0dd7b53512715dc972ea08682c282d612d99a52a0665b5a4d5638d87912259eacea2fa6f004fe57805511677d017b2d201fbc20f624efa62164b41e6b53c7beaa72bca49cd78abedf6eb383a2eff88c60ebf567ee0ba4dfa215fe13698179b690e3fbe38a2cf615c18b67e27bb34ccbd4adb05dfb5a9ea716452f4c3b30acdfafdc5dd7761febb99845315e2b7caf14e716354389fa66d4b81a5673e5538b0e7db3f1cfacf2984e4099d0593e01e85a9d173e14b8af82ebc94a4a2e2e57c2dcad950cc70345eaa45bf1a859cc2e251a0af1452410a0c4c1e499432f6455ad94ce7828757e14760aecef9098be918f93ae76c4cf49bb63b09f9fd19f6289649ba63df24e1c35e7799fdc4f1c393ccdd4152da129d298ec50d6664a27cc97093aeedbc84f158c9565edbefb5b7229e0df054224ecaf9bf9804f58dc6a1aac610cc6cecfcaa434748dbbf50d4825a08618f919c44567186851228dfaf5860bd0e3d83990b7704df84d755b4fb94141bca9fcbc42732c1ca78b163109708356a410f119599b33e296d858277e14434e52b1d754ce64d3f247c6b0195836be1a525a745f1e13b6bbefbf0e1d99a3d1a1e6b53bfdad86a86f7670e2d5c6cdd49dbb04dc4e8ddc557bb3878844ec8ecdd0153c35a72e5cacdf39beb19a606689050e6425a80545212021e7ef5edb94a583b3df8a55bff0001d32625e3acd1b8e4be6b02c1856eed629a8eb5a5282af3df9f9be6257f6b087f409a8a30bd08b0d414eb5836799091456c17a3ca7ef8e9d7bc37603d2de007278339b3f15670638bb0f57510d7f62d084b7e352b0e4fe21c6d712613497f39ae89177c91f3e0b57865e66f5746d166d7cf50080c3147cb708e1e3bd738b301ecba845a3ad34c8cc67df68942c6232772a7428e027988671fe84c530ae394fbf2288b83d0c45e9670b0cfd2493f86b3b5eb02734649cfb25b6a6b3456ac70d1f5a9a92d50c3102254b57779837e137b39f8537fc4ab7418020698fb28cac8837f322cacdb89128bf7ab0c418927fa47c9899d104e3f88be33819f57a5bec8e3f87f5d90246d2c0e7309131927c246be3986b72fb2f930b1c77a584c76b2d0e9e59157235a481b107ffd6a6546f1ef9f6729965994b649dba325b58a7c88baaaad817a6137fd654e34a0f92ef2b485c14e8831f8bcfad2698c74ebecd15ddc91e343456832350468786617d4f5482b42981613053193c7747255a7394979e40ae59cdcb66cbeae013c142cfbe85c2a1bcb43195049f09a7f1ac46e4abb81912ce71abc380bd91b232d20b4a94ff78de8434b043ae4a546b89ee230617e9d95f83a4b0d3b42e592207f69a7fecd521375a17a80fee24c67243e1f45433daaa0d545a2b9b6905ba3b9825315aa90b28df6acecc7af14bccd476122b8718e7f65297c35e49eb5d19b7a636938e55996ea3492f4703f79be9a461cde5cc2f4002cddb59094e48c2fd67a8d87b82d25448828952e09eb722334e811c3b0b4e82cbcbd930314bfff9b2eea3c8968101ac0daccbcbc00705ee137cd797299ae7ae1c497a464ae25a58ea3b727e777bd72404b4f3c61f8fa905d38d408044c4d546050aa83329043c24a549b896daddda2ea0b29670d309725559875bd63846a29c86341af04f70aa6ca54162010498f22a1be9968554fd7465bbb3790ae46c7f2bf313c616ab7a63ec56acf2e755187a84ff46dc78a43096c8ab112ae9d957f378063f03025d4bbc22ec93da234a8880950d2238c8820cc2018b2b3a1cea6109e25be802f3860a87373434df830f4f1b105232b047ea93ae87593f6e4ce9d8f81ca68efde4c11c10289e0fefb99000000000000000210100000800000076ab1cae56484af2c831e0549ecd2748647202352ff8859527bdbe11dcee3a4d34c1a5c24dd7aefaac68c8bc160b1affe1e6b94612ee6307b217023fe60432a30d083854332ab7da8d16279833f33ffb7c4198c350a1c25f7c13ef82a666d94b8aad17e68949a93dd26b692771ebf99a1d9d10da3f58923d08b1bfd2aed0f40000000000000000000000000074e1677f6a332a9304bc802c97f6b284e7ff3c5a85ddf452ecc37e9f5d7ac60b8850bf2c832338e81b34ac2b351850ca5b1e73b4b761560905950bb35b3463ea34b343a543ce90072cdf44b9fa205c833f61e8e1006884072dc8e2b2e6aa559587f6c72c9a20ab8995a5781b"], 0x10a0}, 0x20000005) write(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="000600"/12], 0xc) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt(r5, 0x65, 0x1, &(0x7f0000000080), 0x1d0) bind$can_raw(r5, &(0x7f0000000000), 0x10) close(r5) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x2, &(0x7f0000000080)=0x27e, 0x4) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) executing program 3: socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x0, 0xfffffffd) sendmsg$inet6(r0, &(0x7f0000000480)={&(0x7f0000000000)={0xa, 0x4e23, 0x7, @loopback, 0xfffffffa}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000080)="b4f387ab6bbb09affa37a9b31d908d94", 0x10}, {&(0x7f00000000c0)="a07266c4c866b211bdcca2b57efe329389798549016c640f3c46d296d4be637823fa4970dfe780640233928e761239d0ecc7368d2170d5f1db605beccfc5a33ba703dd5ae47de1b99b87cfd2390e6342aac4e6b0ee998b0d82897ed2535c5ea726d28799157ffdb905d94c96415b4c36e76b44a8c31f382cde3374311006687db3", 0x81}, {&(0x7f0000000180)="a128a221c89decf2ff037466b3c3b5295be22d0d4bd6a1bcb5263ebd18a427691b11b65ae5cb79b1cf58456d0908385d71f2c1064a32179959b250927189eeb85a6dbf9b95c08f80aae7fa89df3a9467fc1cfa520162df50de0a8f77cbad047f5425c7851faa2605b54f454875", 0x6d}, {&(0x7f0000000200)="fd1be0413f05fdc8dc0255c93fdcdf7a74e39af582785c4a074ee60d71b31d7b8e9a750b6ba31b69886847d1d9534233087f308f41f907b2f83382a8f334e53f1ed5ee46336c10e4892fd9d4aa13e07f7d41835392dc8be08382535d1794b775067c520e62d4d501feb39de7a70722ec6c2a7b779f7f7ab7ff218df8e5fc13f8ff65af45f859516c46a6f6c8090669f188ba4ae0c4cae9", 0x97}, {&(0x7f00000002c0)="89f3f3d888a5b57307b9bad71f9b025e26307af99ea0", 0x16}, {&(0x7f0000000300)="16f32b3bd83f6a07fe29427e6e2c8d8fd5602ebb7282b230f35c980e8d435a73ab9f4b887ee8ef73d903966c7d039f2123f9b9eef563ed6fd0b0b017ac56ba1b2b4fc6b3645ea6f575fc44abc1baff9177066188d4e3a265b27dc1de48cbf4de0f04a9c4b23b5502465676803298cee9fde6a4d0f763017dd9309f9ab4c55706537574782333cd05f263cf04079126fdea6e3bb294cc31b2ccd367edf3e022c9274daf1720987d", 0xa7}], 0x6, &(0x7f0000000440)=[@dontfrag={{0x14, 0x29, 0x3e, 0x80}}, @flowinfo={{0x14, 0x29, 0xb, 0x200}}], 0x30}, 0x401) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0xba57, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x12, 0x4, 0x8, 0x8}, 0x48) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x13, r1, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r2, 0x0, 0x3, &(0x7f0000000000)=""/82, &(0x7f0000000080)=0x52) executing program 3: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x10, 0x2, 0xaa4f}, 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYRES8=r0], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="1800000076000907000000000000000007020200f80b708d22834f7eb535f9e7e948396df783e8f33d5032321abd84386a5ed2f15058c4f6b9b769b50ad8faa70fb30bd4e232f5a120c86b32ba3d5d4e3aa40500000068ec7c3cf73e3dd0637fc849fe5f73cc9f6e390f9e8734001b51c91b21b0b0cba43193f74f9a76898024f1af413e3e402654bcadcf9af83f52793b06a90253da45d6b5b896faf0eced83ba0eccddeea38958df88eb", @ANYRES32=0x0], 0x18}, 0x1, 0x5502000000000000}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bpf$ENABLE_STATS(0x20, &(0x7f0000000440), 0x4) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000040)={'wg1\x00', 0x0}) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000200), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000080)={&(0x7f0000000a40)="63d719522ba00183ec370649c931f93760f1e666a84b2480471c4ba34f41bb74a766ec3cd3ff36fdeb54ebd1ad58d03607fa1aa399a143be1ccd298cdd6ff1accaf2577b724f9110c7ebcbb1232152d5eebfafca9b1d1b301abd8032d12e826ba59b453ee90488f7cf0914394387a8e1dc47d9d92bcda1d25aac2aff2c8d7e8ee1c41f4788293ae69b7a29505071", &(0x7f0000000b00)=""/242, &(0x7f0000000c00)="73f9ddf78f5d3ad4933d69cdc49b3917c9ec6dd025b664732b31045f1bb8f70b463c087512724b578daf0596915baa3f327ed693368ba6b6928d86ff7ad599091d01fd74a050288826ed6bcd4f16fbff89b72e3e9336362aa426d5ae8bae8a461055f84105f6151a3803cb292569cc3d3623a2a3fdfc1d3aff1a19edb1edf3d155e0a6cafe9c5fc1f3", &(0x7f0000000cc0)="d00a202d82e01adf07f38cff3c7e95179ed439b5f243e6b27980f855868d248f39899b8abbf5d9d7483cb816e6c649565c19d0e637ebdd991c1ac71f8f6956da84ca1b4a947ced0ee2e3dd68bd5f549cc743bf26f547d1bacb6eae142f6724cdde786e48e6b661ee1a57f0e8f86afcab0cfdd9e44c185f07efcf1698bbfd73809d1dd91819d3d59cddbe0475a5b52148cbe70c0d934ac0f4cd3a464153f059373a4025a797e6ce44b3dcd5a7ea129ec369643414ee12a9ae92625b85dbeb3f251a0e1e5f41", 0x3}, 0x38) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)={0x4c, r10, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_FRAME={0x30, 0x33, @deauth={{{}, {}, @device_b}, 0x0, @val={0x8c, 0x10, {0x0, "0262c80200", @short="094c1f2501e02962"}}}}]}, 0x4c}}, 0x0) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r7, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={&(0x7f00000008c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="300029bd7000fedbdf255300000008000300", @ANYRES32=r11, @ANYBLOB="4c9222b8c19f7da62a060a5b2ead62acbf69050083f83b3649dd1c848fcdecea39f55df3793797e0d4fb844cf52fc2c4d254d3490def7f77e3a8c472b0e2951d7d0efde1b701c45b7adb2ce736cbb9e2844824b57b571cb8a9e6f4699983673ff352f5242ab5b6edae43bce347ecdeeb24f9c93ed0f5740de0f9496f511881ab93df5a460de0cc59edc2126a3d89c32cdb7a6c6f4715cf1dfdbea3cc6cc5b9527cb17e04edb9496619a3e5999a9148318f3c68d3d570c953b43de0312ef207b164aae1011a8b1f7a29275e6dc8e1df48222b70ad2df44b36e6d57be4b2870a901e9950c632088b00a2d81bbfdb93a479716a1fbb677729638b8d61c4013579619dcfd1fd21491601772f2ff23211ab5ae1cca9e10c7746f178b5bda08bb6cf7e02d9069d4361073dc1e5c745de3d39a5d6b0c9e64737d97a7b8ef63b80946dd59e8ac330b099"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r12, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)={0x104, r6, 0x405, 0x0, 0x0, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r5}, @WGDEVICE_A_PEERS={0xbc, 0x8, 0x0, 0x1, [{0xffffff9c, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "5577e9880050c7f502e96f1152ac2aa4cd9a9de7aa3f159b65412d9b8c39cac4"}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x0, @local}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x0, 0x0, @local}}, @WGPEER_A_FLAGS={0x8}, @WGPEER_A_PUBLIC_KEY={0x24}]}]}, @WGDEVICE_A_LISTEN_PORT={0x6}]}, 0x104}}, 0x0) getsockopt$rose(r3, 0x104, 0x6, 0x0, &(0x7f00000002c0)) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x3, &(0x7f0000000580)=@framed, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r13, 0x0, 0x8, 0x7, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_route(0x10, 0x3, 0x0) r14 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r15 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r15, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x18, 0x30, 0x1, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x290, 0x0, 0x150, 0x150, 0xd0, 0x90a, 0x1c0, 0x238, 0x238, 0x1c0, 0x238, 0xf, 0x0, {[{{@uncond, 0x500, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x8}}}}, {{@ipv6={@remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'dvmrp0\x00', 'netpci0\x00'}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f0) executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet(0x2, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000)=0x100, 0x4) recvmmsg(r0, &(0x7f00000021c0), 0x5b, 0x40, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0x40305839, &(0x7f0000000000)=ANY=[]) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={0xffffffffffffffff, 0xe0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000001c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x9, &(0x7f00000006c0)=[0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2b, &(0x7f0000000540)=[{}, {}], 0x10, 0x10, &(0x7f0000000580), &(0x7f00000005c0), 0x8, 0xdd, 0x8, 0x8, &(0x7f0000000600)}}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f0000000840)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x125, 0x125, 0x8, [@union={0xb, 0x7, 0x0, 0x5, 0x1, 0x4, [{0x9, 0x0, 0x4}, {0xf, 0x3, 0x1}, {0x8, 0x0, 0xd03}, {0xd, 0x0, 0x5}, {0xc, 0x2, 0x4e5b}, {0x1, 0x0, 0x4}, {0xa, 0x5, 0x3d}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x4, 0x4}}, @const={0xb}, @union={0x9, 0x6, 0x0, 0x5, 0x0, 0x1ff, [{0x7, 0x3, 0x2}, {0xe, 0x3, 0x2001}, {0x8, 0x2, 0x3ae}, {0x3, 0x0, 0x7}, {0xe, 0x1f, 0xa0d}, {0x9, 0x5, 0x4}]}, @restrict={0x2, 0x0, 0x0, 0xb, 0x2}, @datasec={0x10, 0x3, 0x0, 0xf, 0x1, [{0x5}, {0x1, 0x101, 0x7ff}, {0x100001, 0x24, 0x7ff}], '9'}, @int={0xc, 0x0, 0x0, 0x1, 0x0, 0x34, 0x0, 0x23, 0x1}]}, {0x0, [0x5f, 0x30, 0x61, 0x61, 0x61, 0x6f]}}, &(0x7f00000009c0)=""/225, 0x148, 0xe1, 0x1, 0x1}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="27ae000000000000b7080000000000007b8af8ff03000000bfa2000000000000f8ffffffb703000008000000b704000000000000850000000100000018010000786c6c2500000000002020207b1af8ff00000000bfa100000004000007010000f8ffffffb702000008000000b703000000000000850000000f0000009500000000"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r1, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001680)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r2, 0x400454c9, 0xba98575a95aeb70d) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000580)="e02742e8680d85292c00002f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000180)={@broadcast, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [@hopopts={0x2c}]}}}}}}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="0000000065a1f587b21600004acae67f2cd3dab53ac5652a641f2161d6e2d7aba3998d50ca29560971e15a74b13b2b5d32d9dd6c490eb101a472ad38ebba3c6317279abdd1039cd09e939ac1d2b6a20ff528bc104b3d86dd5b3398943dbb39f8cb241faf647cfaac5c786915e64dbd2cdf113975821fda0d8a4ba65a3a400959eace3f6b8a9cf88c9c98336c571ed6a4bfc10379912114fd3bc54d5df43338c0b0dfb3063cc1c548e422771836b02cdac693379b69073c70204dd00d11d51e73d4fdf8d135e3be5d31015a094ad23a1d5f49d55d5a73ec2c271227a872d4c6b98282cacc9536e43957da4588b05b019ead0a3d76ed25250ca1effd4caed7f692", @ANYRES16=r3, @ANYBLOB="100028bd7000fbdbdf250800000020000380060007004e2300001400020076657468305f6d61637674617000000008000500ff070000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x8001) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r5}, 0x4) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x1a0, 0x1a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x0, 0x10000000}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x13, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff000083a6340c715774ff000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000d0e94ad9ece636246f4b41126f85c29d0da327ad3f4c197b14548adf16c32bec8da20c5fb3fc073205c21edab3765d5e73aca6bd930d0346d217a7b9f38aad2a35d636f99f103b24917b3b4da2e0b341b64e32a6ce8ce8b1b30b4b0db865bd8766e52796", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000a00000085000000a50000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r4) close(0xffffffffffffffff) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r7, &(0x7f0000000000)={0x20000010}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r1, 0x1a0a5000) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair(0x11, 0x3, 0x102, &(0x7f00000007c0)) sendto$inet6(r8, &(0x7f0000000100)='b', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000640)=[@in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x3, @remote, 0x3}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x7, @loopback, 0xff}, @in6={0xa, 0x4e21, 0x2, @empty, 0x6}, @in6={0xa, 0x4e24, 0x3f, @loopback, 0xe8d}], 0x9c) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x17, 0x3, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x60}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}, @IFLA_MTU={0x8, 0x4, 0x40000500}]}, 0x50}}, 0x0) executing program 2: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000900)=""/221, 0xdd}, {&(0x7f0000000d00)=""/249, 0xf9}, {&(0x7f0000002140)=""/4043, 0xfcb}, {&(0x7f0000000a00)=""/235, 0xeb}, {&(0x7f00000007c0)=""/182, 0xb6}, {&(0x7f0000000b00)=""/211, 0xd3}, {&(0x7f0000000600)=""/179, 0xb3}, {&(0x7f0000000cc0)=""/59, 0x3b}], 0x8}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=@framed, &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="25003300d0000000080211000001080211000000505050505050000003"], 0x44}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x0, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="61155000000000006113500000000000bfa000000000000007000000ee0016055e03010000000000250500000000000069163e0000000000bf07000000000000260507000fff0720670600003f000000140300000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871"], 0x0}, 0x90) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @union={0x0, 0x0, 0x0, 0xb, 0x0, 0x2}]}}, 0x0, 0x4e}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000002c0)="b9ff03076003008cb89e08f086dd", 0x0, 0x0, 0x60000000, 0x0, 0xfffffffffffffce7, 0x0, 0x0}, 0x50) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) socket(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x7c, 0x10, 0x421, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x0, 0x61}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x4}, @IFLA_GRE_OKEY={0x8, 0x5, 0xda4b}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e21}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x1}, @IFLA_GRE_ENCAP_DPORT={0x6}]}}}, @IFLA_LINK={0x8}, @IFLA_MASTER={0x8}, @IFLA_ADDRESS={0xa, 0x1, @dev}]}, 0x7c}}, 0x0) write$binfmt_misc(r5, &(0x7f0000000200)=ANY=[@ANYBLOB="4900030007"], 0xd) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x61}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r8, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r3, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x1}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4040814}, 0x48001) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b05d25a806c8c6f94f90424fc601000127a0a000612073582c137153e37080c18800bac0f000300", 0x33fe0}], 0x1, 0x0, 0x0, 0x8100000}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r9 = socket$netlink(0x10, 0x3, 0x4) writev(r9, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) executing program 4: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan0\x00', 0x0}) bind$can_raw(0xffffffffffffffff, &(0x7f0000000240)={0x1d, r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0xfea7) sendfile(r0, r2, &(0x7f0000000000), 0x11) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="5e873a1800"/14], &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) executing program 1: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ff00ff85000000040000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$phonet(0x23, 0x2, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002e00)=ANY=[@ANYBLOB], 0x108}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010200000000000000000000000a70000000060a0904000000000000000002000000440004802c0001800e000100696d6d656469617465000000180002800c00028005000100c4000000080001400000000914000180090001006861736800000000040002800900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x98}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'vlan0\x00', 0x0}) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000080)=0xf3e, 0x62) sendto$packet(r2, &(0x7f00000000c0)="3f033608260812002c001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c56090", 0x3b, 0x0, &(0x7f0000000540)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001600)=ANY=[@ANYBLOB="1c0000002a000921bb5a8fffff0000000400002c24101a8004000400"], 0x1c}, 0x1, 0x3000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffff2) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r7, &(0x7f0000000000), 0x6e000) executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r2, 0x111, 0x2, 0x0, 0x20000000) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x350, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0x100, 0x128, 0x0, {}, [@common=@inet=@tcp={{0x30}}, @common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) executing program 2: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000180)={@broadcast, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [@hopopts={0x2c}]}}}}}}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="0000000065a1f587b21600004acae67f2cd3dab53ac5652a641f2161d6e2d7aba3998d50ca29560971e15a74b13b2b5d32d9dd6c490eb101a472ad38ebba3c6317279abdd1039cd09e939ac1d2b6a20ff528bc104b3d86dd5b3398943dbb39f8cb241faf647cfaac5c786915e64dbd2cdf113975821fda0d8a4ba65a3a400959eace3f6b8a9cf88c9c98336c571ed6a4bfc10379912114fd3bc54d5df43338c0b0dfb3063cc1c548e422771836b02cdac693379b69073c70204dd00d11d51e73d4fdf8d135e3be5d31015a094ad23a1d5f49d55d5a73ec2c271227a872d4c6b98282cacc9536e43957da4588b05b019ead0a3d76ed25250ca1effd4caed7f692", @ANYRES16=r3, @ANYBLOB="100028bd7000fbdbdf250800000020000380060007004e2300001400020076657468305f6d61637674617000000008000500ff070000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x8001) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r6}, 0x4) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x1a0, 0x1a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x0, 0x10000000}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x13, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff000083a6340c715774ff000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000d0e94ad9ece636246f4b41126f85c29d0da327ad3f4c197b14548adf16c32bec8da20c5fb3fc073205c21edab3765d5e73aca6bd930d0346d217a7b9f38aad2a35d636f99f103b24917b3b4da2e0b341b64e32a6ce8ce8b1b30b4b0db865bd8766e52796", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000a00000085000000a50000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r4) close(r5) socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000010}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r1, 0x1a0a5000) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair(0x11, 0x3, 0x102, &(0x7f00000007c0)) sendto$inet6(r8, &(0x7f0000000100)='b', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000640)=[@in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x3, @remote, 0x3}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x7, @loopback, 0xff}, @in6={0xa, 0x4e21, 0x2, @empty, 0x6}, @in6={0xa, 0x4e24, 0x3f, @loopback, 0xe8d}], 0x9c) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x17, 0x3, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x60}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}, @IFLA_MTU={0x8, 0x4, 0x40000500}]}, 0x50}}, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: bisecting 24 programs bisect: split chunks (needed=false): <24> bisect: split chunk #0 of len 24 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m44s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 26, 13, 24, 30, 18, 30, 30, 6, 26, 21, 19, 13, 26, 22, 30] detailed listing: executing program 3: recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x4e22, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000200)='westwood\x00', 0x9) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, 0x0) writev(r0, &(0x7f0000000240)=[{&(0x7f0000000280)='g', 0x1}], 0x1) executing program 4: r0 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000240)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000200)={r1, 0x1, 0x6}, 0x10) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001fc0)=ANY=[@ANYBLOB="340000001800290200000000000000000200000008000000000000001500098008000000", @ANYRES32=0x0], 0x34}}, 0x0) r3 = socket(0x2, 0x0, 0x0) sendto$unix(r3, &(0x7f0000000180)="759f3906d915ecc50a23ddb13ac813a75bb3f7e54d453e2a5aa757d57d897e1e709679ad8b5abbcf8fb36d", 0x2b, 0x0, &(0x7f00000002c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) setsockopt$EBT_SO_SET_ENTRIES(r3, 0xa00000000000000, 0x80, &(0x7f0000000000)=@broute={'broute\x00', 0x20, 0x1, 0x948, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000010000000068000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff010000000b00000000000000000062726964676530000000000000000000626f6e645f736c6176655f3000000000736974300000000000000000000000007465716c3000000000000000000000000000000000000000000000000180c20000000000000000000000b8080000b8080000e8080000616d6f6e670000000000000000000000001b00000000000000000400000000001804000000000000000000000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d00000000fa0100000000000000000000000000000000000000000000000000000000004037118bc35d3037960000000000000000000000000000000000000000000000000000000000001f0000000000000000000000938d5e000000000000558d7a2006c2257800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e4f500000000000000000300020000000000000000006c00000000000000000000000000000000000000000000000000000000000000000000000000892f9284b45f00000000000000000000000000000000a600000000000000000000000040f9ffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000080000001567cc0fb18ebd10677f000000000000000000000000b038562daba737bd000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c50000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000ce90b91aedadb0c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ce113362da06e0fa83f39b50390000000000000000ed2c14bc1d077b4817d693d02c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000037ff1cf2f8e52e074300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d659920000000000e5c7ffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000cbcb951a4f0f3300ebb39c00000000000000000000000000000000000000000000000000000000000000000000000000e70000000000053cbf7eee533b170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fffffffffffffff80000ff0f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002292091a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c1a8a95ba6a3ba677371c303b5426300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c81e00"/2079]}, 0x897) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000080)="ab553fec94248c32", 0x8) r4 = accept$alg(0xffffffffffffffff, 0x0, 0x0) write$binfmt_script(r4, &(0x7f0000000100)={'#! ', '', [], 0xa, "000000000000c93dd4fb1b25"}, 0x10) recvmmsg(r4, &(0x7f000000ec00)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000006a40)=[{&(0x7f0000005380)=""/1, 0x1}], 0x1}}], 0x2, 0x0, 0x0) setsockopt$packet_add_memb(r0, 0x107, 0x1, 0x0, 0x0) setsockopt$SO_RDS_TRANSPORT(0xffffffffffffffff, 0x114, 0x8, &(0x7f0000000000), 0x4) bind$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @loopback}, 0x1c) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000001f80)={&(0x7f0000000340)=@pppol2tpv3in6={0x18, 0x1, {0x0, r3, 0x0, 0x4, 0x1, 0x2, {0xa, 0x4e20, 0x8, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0xe6}}}, 0x80, &(0x7f0000000e80)=[{&(0x7f00000001c0)}, {&(0x7f0000000440)="c511d616722fef1fa532865fe4ce053e52c5ac69da8cbbddb63e2fb55aed100ca9c4164ddf6c", 0x26}, {&(0x7f0000000e00)="3b31d64484e641d54cdcb728f0de0da32bac2f19b9bfb307e873093a3b19f3af01ef10e933a2f114327e4cdb18e696b360f0911263de124a0d89bd59d93f1662eb225abd1de9", 0x46}], 0x3, &(0x7f00000020c0)=ANY=[@ANYBLOB="10100000000000000d010000afffffffd624a44d730da7adf135eb1533acb970e4d860e0bc2a13901cd6f200e07d647e1c05f7baafaad51196ae8c7fea74aa0708fe9d0338090c309e130afcc3ff8a7ecb5079fcf96749df2bdeea51cb4b0b46cfa65942b1bc53964da55cf68f283ce46f4c2c4f8dd766abf3363a96b5ab38caa850e17152181a37be911716bb9e48869652cc4413789ca3ce53a961267b403c46ab8b9fa4c817449cad41295eb3b9210d2e881747b1d4330f82906792580dd750d98f42868c3e2e9d4e00c5567eabe0728f0b553cab9ceb02d4061ad88eb09ec14681a35a9bb818763c0bdff1d5fee6a3a51aece00efc3d2f5bda010bd83904e6ef426b7390e4d0e9f057b2895fa40c7fb9b61ddc0b5f144f9d1ab3249890561f57f5db7ae27bf3a574cc20624d52ad9aed33280139ceda357bdeffa53814db63647fbb8ea80565206dc7dfbd8b1f144def537e32c031fbcb3119b88a761aa98821a3ff0b1cac9b32f45d1a7233a1a8dfb517179f82ac0a4458761cdb50234433500aa46aa96d4ec14aa37afab47ab68016a6d1bc7ea8c4dba070371e4579147bb00f549c001b22c94ee6631f3e901014165bcbe00cc40219d80cf0dad6b8a5448d674d8d47afb9b4ff1ae0fe5707f8426a655ae7ec4f0603cf4cb27c2e291fa08b5f321b4e82b35d32c426bf0b1410838f4bbff6204821f303f7e8953005b34091b52796a524491c9b89c548460910496ad68341bf6c9bf9dacf6555b50cd32638786924c47e694f8ab60e632687a03f53f9e6f0ad60c7cfbe5a62d3c33de4bffdcc46730fc28c330fbaf461915a6e98814d8c37f9fa0a5799b905f6eb1147eed18a2aa2d60ea50873de0aed758c4e56419287d76cfc68c545847af1643481254433341d973c5cb41a690cca67d00db9dd5712a207aca657cd7b428d05b13eb60b957122367aa22c247f9b160897445f86f7defbf543cddf1de533097b35203850faca170d5c52da7f83ff27156c6e517c57109d6eb902d2cf36d972166ec3968af1fcadb430627e9f721a0526904f9be0c8a6dda7ee267b021c0406ac616d6f55f472d40d64e4cf352d569c4f5213e2c9a8fdd86ad834ccad031c1e561e5ae9d8ac5c0f80ee0aeaf99f25e300967f63328eb515c0af803e55a58e9c14c449e6c0f75482a8c6d704db9d4b38d2a9e189daeaac546f4df1e80d10c5cd9b95415edaedc01c1bc9e3fbaf4c42649af79000a4ee663602eb5d42232703a27dcbaca54b1d0d69535fa2dc9266e6c74311cf6f596d356dec7172d792190f45df4233713999e6baa86dcd131ead38cdad1aff2d0989c732543146d345dc0a1131b21f66028502fba79075c13d385767ab2415d64f689a4cc417a1aa509c5e4f4a59a0be5b21c1b90bbc7a4d754a318dedccefd93d5cad7a56790c02eed690607e3a0c00aa3564a6f9cab77561653b4397bc7584cb21d57f98107dbddb26082c55f596a04916364488248d34e78d0174264e60c54f3294495e86f1d936ab1c540c20360ac264a90497730db3027c649ab12447d83280ed74cbc9badafcc4337c3d86e9723f01805178b96a8c71d3580cd6acdeab345d2e8089b6c3beca14a2f8716e1ec9790e122bb46b3ae7f8318a2a2a1e0bff9f320dbbca1b2f6037f43aaa0528d0cc3b9fe0452f78a58192877ba09f4edab5bfc5d0dfb5b3c467cc23a323def408d0b8342c9e40f93abab24fca7f9d7f0860f98a5d6ef80f56ba46b729bb9c2c495a0a8485318920cbbb145c67c62058137e166dc4c966b11448c8b7d7373f2b83fa6faf7fe4f5f8a530828aed99f7c39993f789305aeac6aad55a956fb779b8f4c67f9639e3dceaeafd41da4d1d99c34613f75ab4a4fd8af65c6bc0ff17e2e9e5ebb64be04979c105914c51b142e45cbb17d2694251f2beef0fd0078210fb1f949dcda554fbd8af98ef08536083ce5068b31b3cdaeb2aac86178f8ef2ae2b3195b658916daf6f93a0bc5deff8a38ef0d150572f23d3da35a9908c87ce9fee7305ccf6f3b5b581a11f0afd822d0c53e6b1abb7e8f350922161b29258541635e0acb5a280e2eba998ae73b30f883e1b6ff5adbf1e6a2e8a9d3b5de1b6f2484b4925547d06f3b0ce9aece9212d7f6dcd6b9ca3c73ff172a3fbf85ed523a2460854ca4c17fc286d3634c533f6018585513e598c8336e1d3153cccea0d8c9b1e4b162a9c18fa84d8eb5f87e70db2fd1adb8e8e442f19e3fdfa7d953a999f2a98773981a134b813bf6178d86ba69d4dece4d1c3224864c636c285c4f468ddb1307cf15d654d360f3b1baa3351750c4a1acd71a35fbfa224ed0b566d7315107fb57864f1b1ca51816210b7e06da5910218fd8cf6e5e9eddacc35616dd7687a4305c3c5fa94b50133ba47e8e9ac0cf1217fc3364c374de467807e3b7c1ccf31fe6a923d59f0ad38396c0afcadd386eb652bc2138ce113d1006ba26c5679875508f9ac3a386ebbd1491f9ac485348e6ce01d665749c4878ac2becbfdfa23dd5bd784959e38d742a88521eb487d8be650c34194e3098912e7dcdd20fa9b91569a2463795a0f11c1afd522cc4ff67f3ad80c399d5476232676697ce7411acd9f366e994725e898c8b44b6c1ec639a99701654af08ab7970ff8827a7176c1a0237ed48d1867cb32d2c748bb2f67b6477e5576a8f4168475ef7d90f901c57f8ee7e4c3c4d2c13822f5f88501d8f654ae4e632d1979bf77e80b7ef57fed06144c2da5a8e401e377ac31c936548d3bf2b92919bc28617fddccfdf752257836f8b9b48f021d9e58d419dda2df4030172b846f30b4cdbbfaf0742d8724641990143d61789a905c58cae572808070ff4329b46880f897e97e8a909ddea42455445512bc5d0bcf916c2440b73d3f435feb08f8a60a682b6b4749f0bf36f818424cfb0fe33a67f9224199ab09f4d38576cf6e4fa1dfd840d36e07ce302cde5fc008acd8352d205883c2a9f42a1a273717d42a3bfa1fa33b05e3c8b0d8ba27ee6817250fcd39486e9ebbd7cf943865b8ae36a9b8a1a80425cc71f44f69b39a5df8fb51c4d31a73c2bf1eb39d4f73567b5989ad8d40e4ff9f526005673bd9f6807f6e31ed4e78fba452fb61aca11f3e57f8c672bbe97b928db6c505c011f700f8da522f5a96db4a391abfe52a030d336dd0ac886dc5ffa9cf8f42b793bc018feb979e8a4194efe62d31adacbbc5aeea341bfafdb9ce6390971d533eb3d24d4db6d16c1b912eac85bc5de4134092d199eb0d3ef16204deddcf06dda471241fbdbe7fdb08d82aa575fa68c438f728f9a20215f01f81fb48662a0daf22ac7c0a6076f2cd48f6a5aad8857a0cddc3a07a4c7924453d3b44164a87b0cc87317eecd8f33512f80897d2a439d93dba0b585ddb1237e6a20b60917bdc52a844e9b7701586b34ac8ff52c60c7d80db83b6ff3ed667adef7b8b9de05411173541d914b8f03dbd73574dc3ae7e46c43bf9ce1c87451447b817c8efb4c3ec2e0a9370a5239ab0cdb9669539bd08aaf582f7d78759b32f5f9099aeb00d843e4f9e14d4a893073433503a6f5288c37c91c764ad8c410368e1eb4cd9a4c2085feca996b83abb2dd83a2f462b5e7748927a95006f7d08a1dbf1c42544abead5e73c3ab11038e5f7122205f7a5f207fb7c27daf781130460eed5aa607808de7231f55939657e4d5dbc93292d80f995d9c283d894952dfd7a5fb91b82b1769e41c203059c7ba1449fa1bd7958f99850e5dbf4d40d3e6ebe3038df3e0b9e13fffd1080232e7a4250761e5e32f68646c88a9e1eec544edd8af68c5521996adf2a07dfec87aab3e2de9d96705ac7b0b8be39d7d4c0296cf43bf00812e8ae516c67ea83298debd1894375ae2c6cc8e402372362a706d927a90bdc48e67671083d3de3d41be9d1618b21b7ab2bb1556dc824d0435d023b6448fe0f60bee0dd7b53512715dc972ea08682c282d612d99a52a0665b5a4d5638d87912259eacea2fa6f004fe57805511677d017b2d201fbc20f624efa62164b41e6b53c7beaa72bca49cd78abedf6eb383a2eff88c60ebf567ee0ba4dfa215fe13698179b690e3fbe38a2cf615c18b67e27bb34ccbd4adb05dfb5a9ea716452f4c3b30acdfafdc5dd7761febb99845315e2b7caf14e716354389fa66d4b81a5673e5538b0e7db3f1cfacf2984e4099d0593e01e85a9d173e14b8af82ebc94a4a2e2e57c2dcad950cc70345eaa45bf1a859cc2e251a0af1452410a0c4c1e499432f6455ad94ce7828757e14760aecef9098be918f93ae76c4cf49bb63b09f9fd19f6289649ba63df24e1c35e7799fdc4f1c393ccdd4152da129d298ec50d6664a27cc97093aeedbc84f158c9565edbefb5b7229e0df054224ecaf9bf9804f58dc6a1aac610cc6cecfcaa434748dbbf50d4825a08618f919c44567186851228dfaf5860bd0e3d83990b7704df84d755b4fb94141bca9fcbc42732c1ca78b163109708356a410f119599b33e296d858277e14434e52b1d754ce64d3f247c6b0195836be1a525a745f1e13b6bbefbf0e1d99a3d1a1e6b53bfdad86a86f7670e2d5c6cdd49dbb04dc4e8ddc557bb3878844ec8ecdd0153c35a72e5cacdf39beb19a606689050e6425a80545212021e7ef5edb94a583b3df8a55bff0001d32625e3acd1b8e4be6b02c1856eed629a8eb5a5282af3df9f9be6257f6b087f409a8a30bd08b0d414eb5836799091456c17a3ca7ef8e9d7bc37603d2de007278339b3f15670638bb0f57510d7f62d084b7e352b0e4fe21c6d712613497f39ae89177c91f3e0b57865e66f5746d166d7cf50080c3147cb708e1e3bd738b301ecba845a3ad34c8cc67df68942c6232772a7428e027988671fe84c530ae394fbf2288b83d0c45e9670b0cfd2493f86b3b5eb02734649cfb25b6a6b3456ac70d1f5a9a92d50c3102254b57779837e137b39f8537fc4ab7418020698fb28cac8837f322cacdb89128bf7ab0c418927fa47c9899d104e3f88be33819f57a5bec8e3f87f5d90246d2c0e7309131927c246be3986b72fb2f930b1c77a584c76b2d0e9e59157235a481b107ffd6a6546f1ef9f6729965994b649dba325b58a7c88baaaad817a6137fd654e34a0f92ef2b485c14e8831f8bcfad2698c74ebecd15ddc91e343456832350468786617d4f5482b42981613053193c7747255a7394979e40ae59cdcb66cbeae013c142cfbe85c2a1bcb43195049f09a7f1ac46e4abb81912ce71abc380bd91b232d20b4a94ff78de8434b043ae4a546b89ee230617e9d95f83a4b0d3b42e592207f69a7fecd521375a17a80fee24c67243e1f45433daaa0d545a2b9b6905ba3b9825315aa90b28df6acecc7af14bccd476122b8718e7f65297c35e49eb5d19b7a636938e55996ea3492f4703f79be9a461cde5cc2f4002cddb59094e48c2fd67a8d87b82d25448828952e09eb722334e811c3b0b4e82cbcbd930314bfff9b2eea3c8968101ac0daccbcbc00705ee137cd797299ae7ae1c497a464ae25a58ea3b727e777bd72404b4f3c61f8fa905d38d408044c4d546050aa83329043c24a549b896daddda2ea0b29670d309725559875bd63846a29c86341af04f70aa6ca54162010498f22a1be9968554fd7465bbb3790ae46c7f2bf313c616ab7a63ec56acf2e755187a84ff46dc78a43096c8ab112ae9d957f378063f03025d4bbc22ec93da234a8880950d2238c8820cc2018b2b3a1cea6109e25be802f3860a87373434df830f4f1b105232b047ea93ae87593f6e4ce9d8f81ca68efde4c11c10289e0fefb99000000000000000210100000800000076ab1cae56484af2c831e0549ecd2748647202352ff8859527bdbe11dcee3a4d34c1a5c24dd7aefaac68c8bc160b1affe1e6b94612ee6307b217023fe60432a30d083854332ab7da8d16279833f33ffb7c4198c350a1c25f7c13ef82a666d94b8aad17e68949a93dd26b692771ebf99a1d9d10da3f58923d08b1bfd2aed0f40000000000000000000000000074e1677f6a332a9304bc802c97f6b284e7ff3c5a85ddf452ecc37e9f5d7ac60b8850bf2c832338e81b34ac2b351850ca5b1e73b4b761560905950bb35b3463ea34b343a543ce90072cdf44b9fa205c833f61e8e1006884072dc8e2b2e6aa559587f6c72c9a20ab8995a5781b"], 0x10a0}, 0x20000005) write(0xffffffffffffffff, 0x0, 0x0) write$binfmt_misc(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="000600"/12], 0xc) r5 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt(r5, 0x65, 0x1, &(0x7f0000000080), 0x1d0) bind$can_raw(r5, &(0x7f0000000000), 0x10) close(r5) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x2, &(0x7f0000000080)=0x27e, 0x4) bind$inet(r6, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) executing program 3: socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_DETACH(0x8, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = socket$inet6(0xa, 0x0, 0xfffffffd) sendmsg$inet6(r0, &(0x7f0000000480)={&(0x7f0000000000)={0xa, 0x4e23, 0x7, @loopback, 0xfffffffa}, 0x1c, &(0x7f00000003c0)=[{&(0x7f0000000080)="b4f387ab6bbb09affa37a9b31d908d94", 0x10}, {&(0x7f00000000c0)="a07266c4c866b211bdcca2b57efe329389798549016c640f3c46d296d4be637823fa4970dfe780640233928e761239d0ecc7368d2170d5f1db605beccfc5a33ba703dd5ae47de1b99b87cfd2390e6342aac4e6b0ee998b0d82897ed2535c5ea726d28799157ffdb905d94c96415b4c36e76b44a8c31f382cde3374311006687db3", 0x81}, {&(0x7f0000000180)="a128a221c89decf2ff037466b3c3b5295be22d0d4bd6a1bcb5263ebd18a427691b11b65ae5cb79b1cf58456d0908385d71f2c1064a32179959b250927189eeb85a6dbf9b95c08f80aae7fa89df3a9467fc1cfa520162df50de0a8f77cbad047f5425c7851faa2605b54f454875", 0x6d}, {&(0x7f0000000200)="fd1be0413f05fdc8dc0255c93fdcdf7a74e39af582785c4a074ee60d71b31d7b8e9a750b6ba31b69886847d1d9534233087f308f41f907b2f83382a8f334e53f1ed5ee46336c10e4892fd9d4aa13e07f7d41835392dc8be08382535d1794b775067c520e62d4d501feb39de7a70722ec6c2a7b779f7f7ab7ff218df8e5fc13f8ff65af45f859516c46a6f6c8090669f188ba4ae0c4cae9", 0x97}, {&(0x7f00000002c0)="89f3f3d888a5b57307b9bad71f9b025e26307af99ea0", 0x16}, {&(0x7f0000000300)="16f32b3bd83f6a07fe29427e6e2c8d8fd5602ebb7282b230f35c980e8d435a73ab9f4b887ee8ef73d903966c7d039f2123f9b9eef563ed6fd0b0b017ac56ba1b2b4fc6b3645ea6f575fc44abc1baff9177066188d4e3a265b27dc1de48cbf4de0f04a9c4b23b5502465676803298cee9fde6a4d0f763017dd9309f9ab4c55706537574782333cd05f263cf04079126fdea6e3bb294cc31b2ccd367edf3e022c9274daf1720987d", 0xa7}], 0x6, &(0x7f0000000440)=[@dontfrag={{0x14, 0x29, 0x3e, 0x80}}, @flowinfo={{0x14, 0x29, 0xb, 0x200}}], 0x30}, 0x401) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000004c0)={0x1b, 0x0, 0x0, 0xba57, 0x0, 0xffffffffffffffff, 0x1, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x4}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x12, 0x4, 0x8, 0x8}, 0x48) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x13, r1, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$bt_hci(r2, 0x0, 0x3, &(0x7f0000000000)=""/82, &(0x7f0000000080)=0x52) executing program 3: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x13, 0x10, 0x2, 0xaa4f}, 0x48) socket$inet_icmp_raw(0x2, 0x3, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 2: r0 = socket$inet6_udp(0xa, 0x2, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYRES8=r0], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x10}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={0x0, r1}, 0x10) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="1800000076000907000000000000000007020200f80b708d22834f7eb535f9e7e948396df783e8f33d5032321abd84386a5ed2f15058c4f6b9b769b50ad8faa70fb30bd4e232f5a120c86b32ba3d5d4e3aa40500000068ec7c3cf73e3dd0637fc849fe5f73cc9f6e390f9e8734001b51c91b21b0b0cba43193f74f9a76898024f1af413e3e402654bcadcf9af83f52793b06a90253da45d6b5b896faf0eced83ba0eccddeea38958df88eb", @ANYRES32=0x0], 0x18}, 0x1, 0x5502000000000000}, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0) bpf$ENABLE_STATS(0x20, &(0x7f0000000440), 0x4) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(r4, 0x8933, &(0x7f0000000040)={'wg1\x00', 0x0}) r6 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000200), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), 0xffffffffffffffff) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000080)={&(0x7f0000000a40)="63d719522ba00183ec370649c931f93760f1e666a84b2480471c4ba34f41bb74a766ec3cd3ff36fdeb54ebd1ad58d03607fa1aa399a143be1ccd298cdd6ff1accaf2577b724f9110c7ebcbb1232152d5eebfafca9b1d1b301abd8032d12e826ba59b453ee90488f7cf0914394387a8e1dc47d9d92bcda1d25aac2aff2c8d7e8ee1c41f4788293ae69b7a29505071", &(0x7f0000000b00)=""/242, &(0x7f0000000c00)="73f9ddf78f5d3ad4933d69cdc49b3917c9ec6dd025b664732b31045f1bb8f70b463c087512724b578daf0596915baa3f327ed693368ba6b6928d86ff7ad599091d01fd74a050288826ed6bcd4f16fbff89b72e3e9336362aa426d5ae8bae8a461055f84105f6151a3803cb292569cc3d3623a2a3fdfc1d3aff1a19edb1edf3d155e0a6cafe9c5fc1f3", &(0x7f0000000cc0)="d00a202d82e01adf07f38cff3c7e95179ed439b5f243e6b27980f855868d248f39899b8abbf5d9d7483cb816e6c649565c19d0e637ebdd991c1ac71f8f6956da84ca1b4a947ced0ee2e3dd68bd5f549cc743bf26f547d1bacb6eae142f6724cdde786e48e6b661ee1a57f0e8f86afcab0cfdd9e44c185f07efcf1698bbfd73809d1dd91819d3d59cddbe0475a5b52148cbe70c0d934ac0f4cd3a464153f059373a4025a797e6ce44b3dcd5a7ea129ec369643414ee12a9ae92625b85dbeb3f251a0e1e5f41", 0x3}, 0x38) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)={0x4c, r10, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@NL80211_ATTR_FRAME={0x30, 0x33, @deauth={{{}, {}, @device_b}, 0x0, @val={0x8c, 0x10, {0x0, "0262c80200", @short="094c1f2501e02962"}}}}]}, 0x4c}}, 0x0) sendmsg$NL80211_CMD_UNEXPECTED_FRAME(r7, &(0x7f0000000400)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000340)={&(0x7f00000008c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r8, @ANYBLOB="300029bd7000fedbdf255300000008000300", @ANYRES32=r11, @ANYBLOB="4c9222b8c19f7da62a060a5b2ead62acbf69050083f83b3649dd1c848fcdecea39f55df3793797e0d4fb844cf52fc2c4d254d3490def7f77e3a8c472b0e2951d7d0efde1b701c45b7adb2ce736cbb9e2844824b57b571cb8a9e6f4699983673ff352f5242ab5b6edae43bce347ecdeeb24f9c93ed0f5740de0f9496f511881ab93df5a460de0cc59edc2126a3d89c32cdb7a6c6f4715cf1dfdbea3cc6cc5b9527cb17e04edb9496619a3e5999a9148318f3c68d3d570c953b43de0312ef207b164aae1011a8b1f7a29275e6dc8e1df48222b70ad2df44b36e6d57be4b2870a901e9950c632088b00a2d81bbfdb93a479716a1fbb677729638b8d61c4013579619dcfd1fd21491601772f2ff23211ab5ae1cca9e10c7746f178b5bda08bb6cf7e02d9069d4361073dc1e5c745de3d39a5d6b0c9e64737d97a7b8ef63b80946dd59e8ac330b099"], 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r12, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000006c0)={0x104, r6, 0x405, 0x0, 0x0, {}, [@WGDEVICE_A_PRIVATE_KEY={0x24}, @WGDEVICE_A_IFINDEX={0x8, 0x1, r5}, @WGDEVICE_A_PEERS={0xbc, 0x8, 0x0, 0x1, [{0xffffff9c, 0x0, 0x0, 0x1, [@WGPEER_A_FLAGS={0x8}, @WGPEER_A_PRESHARED_KEY={0x24, 0x2, "5577e9880050c7f502e96f1152ac2aa4cd9a9de7aa3f159b65412d9b8c39cac4"}, @WGPEER_A_ENDPOINT4={0x14, 0x4, {0x2, 0x0, @local}}, @WGPEER_A_PUBLIC_KEY={0x24, 0x1, @c_g}]}, {0x50, 0x0, 0x0, 0x1, [@WGPEER_A_ENDPOINT6={0x20, 0x4, {0xa, 0x0, 0x0, @local}}, @WGPEER_A_FLAGS={0x8}, @WGPEER_A_PUBLIC_KEY={0x24}]}]}, @WGDEVICE_A_LISTEN_PORT={0x6}]}, 0x104}}, 0x0) getsockopt$rose(r3, 0x104, 0x6, 0x0, &(0x7f00000002c0)) r13 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x16, 0x3, &(0x7f0000000580)=@framed, &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r13, 0x0, 0x8, 0x7, &(0x7f00000006c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000700)=""/7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) socket$nl_route(0x10, 0x3, 0x0) r14 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r15 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r15, &(0x7f0000005c40)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x18, 0x30, 0x1, 0x0, 0x0, {}, [{0x4}]}, 0x18}}, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000500)=@raw={'raw\x00', 0x3c1, 0x3, 0x290, 0x0, 0x150, 0x150, 0xd0, 0x90a, 0x1c0, 0x238, 0x238, 0x1c0, 0x238, 0xf, 0x0, {[{{@uncond, 0x500, 0xa8, 0xd0}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0x0, 0x8}}}}, {{@ipv6={@remote, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [], [], 'dvmrp0\x00', 'netpci0\x00'}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x2f0) executing program 4: socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$inet(0x2, 0x0, 0x0) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000180)="2000000012005f0214f9f4070000fbe40a0000000000", 0x41d) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY_LEVEL(0xffffffffffffffff, 0x0, 0x2, &(0x7f0000000000)=0x100, 0x4) recvmmsg(r0, &(0x7f00000021c0), 0x5b, 0x40, 0x0) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0x40305839, &(0x7f0000000000)=ANY=[]) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000640)={0xffffffffffffffff, 0xe0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000001c0)=[0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x9, &(0x7f00000006c0)=[0x0], &(0x7f0000000280)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x2b, &(0x7f0000000540)=[{}, {}], 0x10, 0x10, &(0x7f0000000580), &(0x7f00000005c0), 0x8, 0xdd, 0x8, 0x8, &(0x7f0000000600)}}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000680)={&(0x7f0000000840)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x125, 0x125, 0x8, [@union={0xb, 0x7, 0x0, 0x5, 0x1, 0x4, [{0x9, 0x0, 0x4}, {0xf, 0x3, 0x1}, {0x8, 0x0, 0xd03}, {0xd, 0x0, 0x5}, {0xc, 0x2, 0x4e5b}, {0x1, 0x0, 0x4}, {0xa, 0x5, 0x3d}]}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x4, 0x4}}, @const={0xb}, @union={0x9, 0x6, 0x0, 0x5, 0x0, 0x1ff, [{0x7, 0x3, 0x2}, {0xe, 0x3, 0x2001}, {0x8, 0x2, 0x3ae}, {0x3, 0x0, 0x7}, {0xe, 0x1f, 0xa0d}, {0x9, 0x5, 0x4}]}, @restrict={0x2, 0x0, 0x0, 0xb, 0x2}, @datasec={0x10, 0x3, 0x0, 0xf, 0x1, [{0x5}, {0x1, 0x101, 0x7ff}, {0x100001, 0x24, 0x7ff}], '9'}, @int={0xc, 0x0, 0x0, 0x1, 0x0, 0x34, 0x0, 0x23, 0x1}]}, {0x0, [0x5f, 0x30, 0x61, 0x61, 0x61, 0x6f]}}, &(0x7f00000009c0)=""/225, 0x148, 0xe1, 0x1, 0x1}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="27ae000000000000b7080000000000007b8af8ff03000000bfa2000000000000f8ffffffb703000008000000b704000000000000850000000100000018010000786c6c2500000000002020207b1af8ff00000000bfa100000004000007010000f8ffffffb702000008000000b703000000000000850000000f0000009500000000"], &(0x7f0000000700)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000000)={r1, 0xe0, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000001680)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETOFFLOAD(r2, 0x400454c9, 0xba98575a95aeb70d) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000580)="e02742e8680d85292c00002f86dd", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000180)={@broadcast, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [@hopopts={0x2c}]}}}}}}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="0000000065a1f587b21600004acae67f2cd3dab53ac5652a641f2161d6e2d7aba3998d50ca29560971e15a74b13b2b5d32d9dd6c490eb101a472ad38ebba3c6317279abdd1039cd09e939ac1d2b6a20ff528bc104b3d86dd5b3398943dbb39f8cb241faf647cfaac5c786915e64dbd2cdf113975821fda0d8a4ba65a3a400959eace3f6b8a9cf88c9c98336c571ed6a4bfc10379912114fd3bc54d5df43338c0b0dfb3063cc1c548e422771836b02cdac693379b69073c70204dd00d11d51e73d4fdf8d135e3be5d31015a094ad23a1d5f49d55d5a73ec2c271227a872d4c6b98282cacc9536e43957da4588b05b019ead0a3d76ed25250ca1effd4caed7f692", @ANYRES16=r3, @ANYBLOB="100028bd7000fbdbdf250800000020000380060007004e2300001400020076657468305f6d61637674617000000008000500ff070000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x8001) pipe(&(0x7f0000000080)={0xffffffffffffffff}) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r5}, 0x4) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x1a0, 0x1a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x0, 0x10000000}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x13, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff000083a6340c715774ff000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000d0e94ad9ece636246f4b41126f85c29d0da327ad3f4c197b14548adf16c32bec8da20c5fb3fc073205c21edab3765d5e73aca6bd930d0346d217a7b9f38aad2a35d636f99f103b24917b3b4da2e0b341b64e32a6ce8ce8b1b30b4b0db865bd8766e52796", @ANYRES32=r5, @ANYBLOB="0000000000000000b70500000a00000085000000a50000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r4) close(0xffffffffffffffff) r7 = socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r7, &(0x7f0000000000)={0x20000010}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r1, 0x1a0a5000) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair(0x11, 0x3, 0x102, &(0x7f00000007c0)) sendto$inet6(r8, &(0x7f0000000100)='b', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000640)=[@in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x3, @remote, 0x3}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x7, @loopback, 0xff}, @in6={0xa, 0x4e21, 0x2, @empty, 0x6}, @in6={0xa, 0x4e24, 0x3f, @loopback, 0xe8d}], 0x9c) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x17, 0x3, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x60}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}, @IFLA_MTU={0x8, 0x4, 0x40000500}]}, 0x50}}, 0x0) executing program 2: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x74, &(0x7f0000000100)=[{&(0x7f00000001c0)="5c00000012006bab9a3fe3d86e17aa0a046b876c1d0048007ea60864160af36504001a0038001d001931a0e69ee517d34460bc06000000a705251e6182949a3651f60a84c9f4d4938037e70e4509c5bb", 0x33fe0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg$kcm(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000900)=""/221, 0xdd}, {&(0x7f0000000d00)=""/249, 0xf9}, {&(0x7f0000002140)=""/4043, 0xfcb}, {&(0x7f0000000a00)=""/235, 0xeb}, {&(0x7f00000007c0)=""/182, 0xb6}, {&(0x7f0000000b00)=""/211, 0xd3}, {&(0x7f0000000600)=""/179, 0xb3}, {&(0x7f0000000cc0)=""/59, 0x3b}], 0x8}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000040)=@framed, &(0x7f00000000c0)='GPL\x00'}, 0x90) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r4, @ANYBLOB="25003300d0000000080211000001080211000000505050505050000003"], 0x44}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x0, 0x16, &(0x7f0000000180)=ANY=[@ANYBLOB="61155000000000006113500000000000bfa000000000000007000000ee0016055e03010000000000250500000000000069163e0000000000bf07000000000000260507000fff0720670600003f000000140300000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871"], 0x0}, 0x90) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000280)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x34, 0x34, 0x2, [@array={0x0, 0x0, 0x0, 0x3, 0x0, {0x3, 0x2}}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x20}, @union={0x0, 0x0, 0x0, 0xb, 0x0, 0x2}]}}, 0x0, 0x4e}, 0x20) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={0xffffffffffffffff, 0x18000000000002a0, 0xe, 0x0, &(0x7f00000002c0)="b9ff03076003008cb89e08f086dd", 0x0, 0x0, 0x60000000, 0x0, 0xfffffffffffffce7, 0x0, 0x0}, 0x50) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) socket(0x10, 0x2, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x7c, 0x10, 0x421, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, 0x0, 0x61}, [@IFLA_LINKINFO={0x40, 0x12, 0x0, 0x1, @ip6gretap={{0xe}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_GRE_IKEY={0x8, 0x4, 0x4}, @IFLA_GRE_OKEY={0x8, 0x5, 0xda4b}, @IFLA_GRE_ENCAP_SPORT={0x6, 0x10, 0x4e21}, @IFLA_GRE_ERSPAN_DIR={0x5, 0x17, 0x1}, @IFLA_GRE_ENCAP_DPORT={0x6}]}}}, @IFLA_LINK={0x8}, @IFLA_MASTER={0x8}, @IFLA_ADDRESS={0xa, 0x1, @dev}]}, 0x7c}}, 0x0) write$binfmt_misc(r5, &(0x7f0000000200)=ANY=[@ANYBLOB="4900030007"], 0xd) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x61}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r7}}]}, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r8, 0x0, 0xe40, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) sendmsg$NL80211_CMD_DEL_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000140)={0x20, r3, 0x200, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @val={0xc, 0x99, {0x5, 0x1}}}}}, 0x20}, 0x1, 0x0, 0x0, 0x4040814}, 0x48001) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0xd18c9b25, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f03002a000b05d25a806c8c6f94f90424fc601000127a0a000612073582c137153e37080c18800bac0f000300", 0x33fe0}], 0x1, 0x0, 0x0, 0x8100000}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private2}]}, &(0x7f0000000180)=0x10) r9 = socket$netlink(0x10, 0x3, 0x4) writev(r9, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) executing program 4: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan0\x00', 0x0}) bind$can_raw(0xffffffffffffffff, &(0x7f0000000240)={0x1d, r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0xfea7) sendfile(r0, r2, &(0x7f0000000000), 0x11) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="5e873a1800"/14], &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) executing program 1: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ff00ff85000000040000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$phonet(0x23, 0x2, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002e00)=ANY=[@ANYBLOB], 0x108}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010200000000000000000000000a70000000060a0904000000000000000002000000440004802c0001800e000100696d6d656469617465000000180002800c00028005000100c4000000080001400000000914000180090001006861736800000000040002800900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x98}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'vlan0\x00', 0x0}) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000080)=0xf3e, 0x62) sendto$packet(r2, &(0x7f00000000c0)="3f033608260812002c001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c56090", 0x3b, 0x0, &(0x7f0000000540)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001600)=ANY=[@ANYBLOB="1c0000002a000921bb5a8fffff0000000400002c24101a8004000400"], 0x1c}, 0x1, 0x3000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffff2) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r7, &(0x7f0000000000), 0x6e000) executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r2, 0x111, 0x2, 0x0, 0x20000000) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x350, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0x100, 0x128, 0x0, {}, [@common=@inet=@tcp={{0x30}}, @common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) executing program 2: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000180)={@broadcast, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [@hopopts={0x2c}]}}}}}}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="0000000065a1f587b21600004acae67f2cd3dab53ac5652a641f2161d6e2d7aba3998d50ca29560971e15a74b13b2b5d32d9dd6c490eb101a472ad38ebba3c6317279abdd1039cd09e939ac1d2b6a20ff528bc104b3d86dd5b3398943dbb39f8cb241faf647cfaac5c786915e64dbd2cdf113975821fda0d8a4ba65a3a400959eace3f6b8a9cf88c9c98336c571ed6a4bfc10379912114fd3bc54d5df43338c0b0dfb3063cc1c548e422771836b02cdac693379b69073c70204dd00d11d51e73d4fdf8d135e3be5d31015a094ad23a1d5f49d55d5a73ec2c271227a872d4c6b98282cacc9536e43957da4588b05b019ead0a3d76ed25250ca1effd4caed7f692", @ANYRES16=r3, @ANYBLOB="100028bd7000fbdbdf250800000020000380060007004e2300001400020076657468305f6d61637674617000000008000500ff070000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x8001) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r6}, 0x4) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x1a0, 0x1a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x0, 0x10000000}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x13, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff000083a6340c715774ff000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000d0e94ad9ece636246f4b41126f85c29d0da327ad3f4c197b14548adf16c32bec8da20c5fb3fc073205c21edab3765d5e73aca6bd930d0346d217a7b9f38aad2a35d636f99f103b24917b3b4da2e0b341b64e32a6ce8ce8b1b30b4b0db865bd8766e52796", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000a00000085000000a50000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r4) close(r5) socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000010}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r1, 0x1a0a5000) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair(0x11, 0x3, 0x102, &(0x7f00000007c0)) sendto$inet6(r8, &(0x7f0000000100)='b', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000640)=[@in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x3, @remote, 0x3}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x7, @loopback, 0xff}, @in6={0xa, 0x4e21, 0x2, @empty, 0x6}, @in6={0xa, 0x4e24, 0x3f, @loopback, 0xe8d}], 0x9c) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x17, 0x3, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x60}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}, @IFLA_MTU={0x8, 0x4, 0x40000500}]}, 0x50}}, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 26, 21, 19, 13, 26, 22, 30] detailed listing: executing program 4: r0 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f00000000c0)={'vxcan0\x00', 0x0}) bind$can_raw(0xffffffffffffffff, &(0x7f0000000240)={0x1d, r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0xfea7) sendfile(r0, r2, &(0x7f0000000000), 0x11) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, &(0x7f00000000c0)=ANY=[@ANYBLOB="5e873a1800"/14], &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x320, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0xd0, 0xf8, 0x0, {}, [@common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x380) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) executing program 1: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 0: r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ff00ff85000000040000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$phonet(0x23, 0x2, 0x1) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000002e00)=ANY=[@ANYBLOB], 0x108}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010200000000000000000000000a70000000060a0904000000000000000002000000440004802c0001800e000100696d6d656469617465000000180002800c00028005000100c4000000080001400000000914000180090001006861736800000000040002800900010073797a30000000000900020073797a3200000000140000001100010000000000000000000000000a"], 0x98}}, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'vlan0\x00', 0x0}) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000080)=0xf3e, 0x62) sendto$packet(r2, &(0x7f00000000c0)="3f033608260812002c001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c56090", 0x3b, 0x0, &(0x7f0000000540)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001600)=ANY=[@ANYBLOB="1c0000002a000921bb5a8fffff0000000400002c24101a8004000400"], 0x1c}, 0x1, 0x3000000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='memory.events\x00', 0x275a, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0xfffffffffffffff2) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_type(r7, &(0x7f0000000000), 0x6e000) executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r2, 0x111, 0x2, 0x0, 0x20000000) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x350, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0x100, 0x128, 0x0, {}, [@common=@inet=@tcp={{0x30}}, @common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) executing program 2: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000180)={@broadcast, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [@hopopts={0x2c}]}}}}}}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="0000000065a1f587b21600004acae67f2cd3dab53ac5652a641f2161d6e2d7aba3998d50ca29560971e15a74b13b2b5d32d9dd6c490eb101a472ad38ebba3c6317279abdd1039cd09e939ac1d2b6a20ff528bc104b3d86dd5b3398943dbb39f8cb241faf647cfaac5c786915e64dbd2cdf113975821fda0d8a4ba65a3a400959eace3f6b8a9cf88c9c98336c571ed6a4bfc10379912114fd3bc54d5df43338c0b0dfb3063cc1c548e422771836b02cdac693379b69073c70204dd00d11d51e73d4fdf8d135e3be5d31015a094ad23a1d5f49d55d5a73ec2c271227a872d4c6b98282cacc9536e43957da4588b05b019ead0a3d76ed25250ca1effd4caed7f692", @ANYRES16=r3, @ANYBLOB="100028bd7000fbdbdf250800000020000380060007004e2300001400020076657468305f6d61637674617000000008000500ff070000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x8001) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r6}, 0x4) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x1a0, 0x1a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x0, 0x10000000}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x13, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff000083a6340c715774ff000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000d0e94ad9ece636246f4b41126f85c29d0da327ad3f4c197b14548adf16c32bec8da20c5fb3fc073205c21edab3765d5e73aca6bd930d0346d217a7b9f38aad2a35d636f99f103b24917b3b4da2e0b341b64e32a6ce8ce8b1b30b4b0db865bd8766e52796", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000a00000085000000a50000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r4) close(r5) socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000010}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r1, 0x1a0a5000) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair(0x11, 0x3, 0x102, &(0x7f00000007c0)) sendto$inet6(r8, &(0x7f0000000100)='b', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000640)=[@in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x3, @remote, 0x3}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x7, @loopback, 0xff}, @in6={0xa, 0x4e21, 0x2, @empty, 0x6}, @in6={0xa, 0x4e24, 0x3f, @loopback, 0xe8d}], 0x9c) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x17, 0x3, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x60}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}, @IFLA_MTU={0x8, 0x4, 0x40000500}]}, 0x50}}, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <8> bisect: split chunk #0 of len 8 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 26, 22, 30] detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r2, 0x111, 0x2, 0x0, 0x20000000) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x350, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0x100, 0x128, 0x0, {}, [@common=@inet=@tcp={{0x30}}, @common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) executing program 2: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000180)={@broadcast, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [@hopopts={0x2c}]}}}}}}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="0000000065a1f587b21600004acae67f2cd3dab53ac5652a641f2161d6e2d7aba3998d50ca29560971e15a74b13b2b5d32d9dd6c490eb101a472ad38ebba3c6317279abdd1039cd09e939ac1d2b6a20ff528bc104b3d86dd5b3398943dbb39f8cb241faf647cfaac5c786915e64dbd2cdf113975821fda0d8a4ba65a3a400959eace3f6b8a9cf88c9c98336c571ed6a4bfc10379912114fd3bc54d5df43338c0b0dfb3063cc1c548e422771836b02cdac693379b69073c70204dd00d11d51e73d4fdf8d135e3be5d31015a094ad23a1d5f49d55d5a73ec2c271227a872d4c6b98282cacc9536e43957da4588b05b019ead0a3d76ed25250ca1effd4caed7f692", @ANYRES16=r3, @ANYBLOB="100028bd7000fbdbdf250800000020000380060007004e2300001400020076657468305f6d61637674617000000008000500ff070000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x8001) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r6}, 0x4) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x1a0, 0x1a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x0, 0x10000000}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x13, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff000083a6340c715774ff000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000d0e94ad9ece636246f4b41126f85c29d0da327ad3f4c197b14548adf16c32bec8da20c5fb3fc073205c21edab3765d5e73aca6bd930d0346d217a7b9f38aad2a35d636f99f103b24917b3b4da2e0b341b64e32a6ce8ce8b1b30b4b0db865bd8766e52796", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000a00000085000000a50000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r4) close(r5) socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000010}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r1, 0x1a0a5000) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair(0x11, 0x3, 0x102, &(0x7f00000007c0)) sendto$inet6(r8, &(0x7f0000000100)='b', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000640)=[@in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x3, @remote, 0x3}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x7, @loopback, 0xff}, @in6={0xa, 0x4e21, 0x2, @empty, 0x6}, @in6={0xa, 0x4e24, 0x3f, @loopback, 0xe8d}], 0x9c) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x17, 0x3, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x60}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}, @IFLA_MTU={0x8, 0x4, 0x40000500}]}, 0x50}}, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <4> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 30] detailed listing: executing program 2: socket$packet(0x11, 0x0, 0x300) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_freezer_state(r0, &(0x7f0000000140), 0x2, 0x0) write$binfmt_misc(r1, &(0x7f0000000180)={'syz1'}, 0x4) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0xffffffffffffffff) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, r3, &(0x7f0000000040)={0x20000004}) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r5, &(0x7f0000000000)={0x1f, 0x0, @fixed}, 0xe) setsockopt$bt_BT_DEFER_SETUP(r5, 0x112, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000080)=@framed, &(0x7f0000000100)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={0x0, r7}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000980)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x38}, 0x90) sendmsg$NL80211_CMD_GET_FTM_RESPONDER_STATS(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)=ANY=[@ANYBLOB="1c0000091fb68c4c9d6fc2aee5fa6a78cb23878793be1ae061b128ea94bbe5f524affc54bce8ee6237f765fc79ba469da440883c5371f59720864944eece433a86d94e02f2252ddc5fd0e9bdd5ae3ebcc121db6f5f396b9b83240a74d84065cdd5e68d4a9b3b5c8d287d693d2966f2d320c76a86c370330cfdff96837adec3b9649812e58145", @ANYRES16, @ANYBLOB="010000000000000000008200000008000300", @ANYRES32, @ANYBLOB], 0x1c}}, 0x0) epoll_pwait(r4, &(0x7f0000000300), 0x1, 0xfffffffc, 0x0, 0xfffffffffffffff6) executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) socket(0x0, 0x0, 0x0) syz_emit_ethernet(0x72, &(0x7f0000000180)={@broadcast, @dev, @val={@void}, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "f53a04", 0x38, 0x3a, 0x0, @remote, @mcast2, {[], @param_prob={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "508359", 0x0, 0x0, 0x0, @mcast2, @private1={0xfc, 0x1, '\x00', 0x1}, [@hopopts={0x2c}]}}}}}}}, 0x0) r1 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$IPVS_CMD_GET_DEST(r2, &(0x7f0000000740)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000700)={&(0x7f0000000800)=ANY=[@ANYBLOB="0000000065a1f587b21600004acae67f2cd3dab53ac5652a641f2161d6e2d7aba3998d50ca29560971e15a74b13b2b5d32d9dd6c490eb101a472ad38ebba3c6317279abdd1039cd09e939ac1d2b6a20ff528bc104b3d86dd5b3398943dbb39f8cb241faf647cfaac5c786915e64dbd2cdf113975821fda0d8a4ba65a3a400959eace3f6b8a9cf88c9c98336c571ed6a4bfc10379912114fd3bc54d5df43338c0b0dfb3063cc1c548e422771836b02cdac693379b69073c70204dd00d11d51e73d4fdf8d135e3be5d31015a094ad23a1d5f49d55d5a73ec2c271227a872d4c6b98282cacc9536e43957da4588b05b019ead0a3d76ed25250ca1effd4caed7f692", @ANYRES16=r3, @ANYBLOB="100028bd7000fbdbdf250800000020000380060007004e2300001400020076657468305f6d61637674617000000008000500ff070000"], 0x3c}, 0x1, 0x0, 0x0, 0x4085}, 0x8001) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000380)={r6}, 0x4) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x2d0, 0xffffffff, 0x1a0, 0x1a0, 0x0, 0xffffffff, 0xffffffff, 0x238, 0x238, 0x238, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @dev, 0x0, 0x0, 'wg1\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28}}, {{@uncond, 0x287, 0xe0, 0x108, 0x0, {}, [@common=@unspec=@cpu={{0x28}, {0x0, 0x10000000}}, @common=@unspec=@limit={{0x48}}]}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x330) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x13, 0x10, &(0x7f0000000540)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff000083a6340c715774ff000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000d0e94ad9ece636246f4b41126f85c29d0da327ad3f4c197b14548adf16c32bec8da20c5fb3fc073205c21edab3765d5e73aca6bd930d0346d217a7b9f38aad2a35d636f99f103b24917b3b4da2e0b341b64e32a6ce8ce8b1b30b4b0db865bd8766e52796", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000a00000085000000a50000009500000000000000"], &(0x7f0000000500)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) close(r4) close(r5) socket$inet6_udplite(0xa, 0x2, 0x88) epoll_ctl$EPOLL_CTL_ADD(r4, 0x1, 0xffffffffffffffff, &(0x7f0000000000)={0x20000010}) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x3000000, 0x13, r1, 0x1a0a5000) r8 = socket$inet6_sctp(0xa, 0x801, 0x84) socketpair(0x11, 0x3, 0x102, &(0x7f00000007c0)) sendto$inet6(r8, &(0x7f0000000100)='b', 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x0, 0x0, @dev, 0x15}, 0x1c) setsockopt$inet_sctp6_SCTP_INITMSG(r8, 0x84, 0x5, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r4, 0x84, 0x6b, &(0x7f0000000640)=[@in={0x2, 0x4e22, @remote}, @in6={0xa, 0x4e24, 0x3, @remote, 0x3}, @in6={0xa, 0x4e24, 0x1, @mcast1, 0x5}, @in6={0xa, 0x4e21, 0x7, @loopback, 0xff}, @in6={0xa, 0x4e21, 0x2, @empty, 0x6}, @in6={0xa, 0x4e24, 0x3f, @loopback, 0xe8d}], 0x9c) ioctl$EXT4_IOC_SWAP_BOOT(r1, 0x6611) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x17, 0x3, &(0x7f0000000080)=@raw=[@cb_func={0x18, 0x0, 0x4, 0x0, 0xffffffffffffffff}, @exit], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) sendmsg$NFT_BATCH(r9, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5021900000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_EXTHDR_TYPE={0x5}, @NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x60}]}}}]}]}], {0x14}}, 0x8c}}, 0x0) bind$llc(r1, &(0x7f0000000080), 0x10) sendmsg$nl_route(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0xffffff1f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x11689}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @mcast2}]}}}, @IFLA_MTU={0x8, 0x4, 0x40000500}]}, 0x50}}, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 26] detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r2, 0x111, 0x2, 0x0, 0x20000000) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x350, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0x100, 0x128, 0x0, {}, [@common=@inet=@tcp={{0x30}}, @common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$PROG_LOAD-sendmsg$inet-recvmsg$kcm-openat$tun-ioctl$TUNSETIFF-socket$kcm-socket$inet6_sctp-socket$inet6_udplite-socket-socketpair$unix-bpf$ITER_CREATE-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$l2tp6-setsockopt$IP6T_SO_SET_REPLACE-openat$cgroup_ro-openat$cgroup_ro-socket$nl_route-ioctl$sock_SIOCGIFINDEX_80211-ioctl-ioctl$SIOCSIFHWADDR-recvmsg$kcm-openat$cgroup_ro detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x2, 0x0, 0x8, 0x0, 0x1400, 0xffffffffffffffff, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, 0x0, &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$inet(0xffffffffffffffff, 0x0, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$inet6_sctp(0xa, 0x0, 0x84) socket$inet6_udplite(0xa, 0x2, 0x88) r2 = socket(0x10, 0x0, 0x0) socketpair$unix(0x1, 0x0, 0x0, &(0x7f0000000240)) r3 = bpf$ITER_CREATE(0x21, &(0x7f00000003c0), 0x8) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@newqdisc={0x78, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r4, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x0, 0x0, 0x1, 0x8}, 0x7, 0x0, 0x0, 0x2, 0x11b, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x8}}}}]}, 0x78}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x8, 0x4, 0x0, &(0x7f0000000100)='syzkaller\x00', 0x4, 0xeb, &(0x7f00000002c0)=""/235}, 0x90) r5 = socket$l2tp6(0xa, 0x2, 0x73) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x3c1, 0x3, 0x350, 0x128, 0x111, 0x4b4, 0x128, 0xd4feffff, 0x280, 0x20a, 0x278, 0x280, 0x278, 0x3, 0x0, {[{{@ipv6={@empty, @empty, [], [], 'ipvlan0\x00', 'team_slave_0\x00', {}, {}, 0x6}, 0x7a, 0x100, 0x128, 0x0, {}, [@common=@inet=@tcp={{0x30}}, @common=@unspec=@connlabel={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0xffff}}}, {{@ipv6={@loopback, @private1, [], [], 'rose0\x00', 'pim6reg1\x00'}, 0x0, 0xf0, 0x158, 0x0, {}, [@common=@unspec=@nfacct={{0x48}, {'syz1\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'pptp\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3b0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000340)='memory.events\x00', 0x7a05, 0x1700) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan0\x00'}) ioctl(r6, 0x8b2b, &(0x7f0000000040)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) recvmsg$kcm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$rose-ioctl$sock_TIOCINQ-bpf$MAP_CREATE-bpf$MAP_DELETE_ELEM-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp-getsockopt$bt_BT_SECURITY detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r2, 0x111, 0x2, 0x0, 0x20000000) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r2, 0x111, 0x2, 0x0, 0x20000000) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$rose-ioctl$sock_TIOCINQ-bpf$MAP_CREATE-bpf$MAP_DELETE_ELEM-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp-getsockopt$bt_BT_SECURITY detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) getsockopt$bt_BT_SECURITY(r2, 0x111, 0x2, 0x0, 0x20000000) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: concatenation succeeded found reproducer with 13 syscalls minimizing guilty program testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$rose-ioctl$sock_TIOCINQ-bpf$MAP_CREATE-bpf$MAP_DELETE_ELEM-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$rose-ioctl$sock_TIOCINQ-bpf$MAP_CREATE-bpf$MAP_DELETE_ELEM-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$rose-ioctl$sock_TIOCINQ-bpf$MAP_CREATE-bpf$MAP_DELETE_ELEM-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$rose-ioctl$sock_TIOCINQ-bpf$MAP_CREATE-bpf$MAP_DELETE_ELEM-socket$pppl2tp-socket$pppl2tp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$rose-ioctl$sock_TIOCINQ-bpf$MAP_CREATE-bpf$MAP_DELETE_ELEM-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$rose-ioctl$sock_TIOCINQ-bpf$MAP_CREATE-bpf$MAP_DELETE_ELEM-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000180)={r1, &(0x7f0000000340)="13e56852cc1734e10d2805353959befb43e5bf570d601eab67a11f3d679764aa4377d9685abd40e114539206d88262efef79013fa1dcb9993a66a28fc66d434474a5238ffdb7b83dff14f50e5ac79bcddb0e3ac1d0b8647b6bede8"}, 0x20) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$rose-ioctl$sock_TIOCINQ-bpf$MAP_CREATE-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x3, 0x4, 0x1, 0x3c2, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x4}, 0x48) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$rose-ioctl$sock_TIOCINQ-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = syz_init_net_socket$rose(0xb, 0x5, 0x0) ioctl$sock_TIOCINQ(r0, 0x541b, &(0x7f0000000200)) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-syz_init_net_socket$rose-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) syz_init_net_socket$rose(0xb, 0x5, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-syz_genetlink_get_family_id$nl80211-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$nl_generic-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$nbd-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, 0x0, 0x0) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp program did not crash simplifying guilty program options testing program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp program did not crash testing program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x8001, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x25}}, 0x1, 0x3}}, 0x26) program crashed: KASAN: slab-use-after-free Read in l2tp_session_delete extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp program did not crash reproducing took 59m39.234018442s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in l2tp_session_unhash net/l2tp/l2tp_core.c:1256 [inline] BUG: KASAN: slab-use-after-free in l2tp_session_delete+0x128/0x9e0 net/l2tp/l2tp_core.c:1643 Read of size 8 at addr ffff88806d6be010 by task kworker/u8:7/3671 CPU: 1 PID: 3671 Comm: kworker/u8:7 Not tainted 6.10.0-rc4-syzkaller-00948-gcce346d44139 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: l2tp l2tp_tunnel_del_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 l2tp_session_unhash net/l2tp/l2tp_core.c:1256 [inline] l2tp_session_delete+0x128/0x9e0 net/l2tp/l2tp_core.c:1643 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1302 [inline] l2tp_tunnel_del_work+0x1cb/0x330 net/l2tp/l2tp_core.c:1334 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 5255: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:4122 [inline] __kmalloc_noprof+0x1f9/0x400 mm/slub.c:4135 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] l2tp_session_create+0x3b/0xc20 net/l2tp/l2tp_core.c:1675 pppol2tp_connect+0xca3/0x17a0 net/l2tp/l2tp_ppp.c:782 __sys_connect_file net/socket.c:2049 [inline] __sys_connect+0x2df/0x310 net/socket.c:2066 __do_sys_connect net/socket.c:2076 [inline] __se_sys_connect net/socket.c:2073 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2073 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 25: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2196 [inline] slab_free mm/slub.c:4437 [inline] kfree+0x149/0x360 mm/slub.c:4558 __sk_destruct+0x58/0x5f0 net/core/sock.c:2191 rcu_do_batch kernel/rcu/tree.c:2535 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3072 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176 pppol2tp_release+0x24b/0x350 net/l2tp/l2tp_ppp.c:457 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x406/0x8b0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:180 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88806d6be000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 16 bytes inside of freed 1024-byte region [ffff88806d6be000, ffff88806d6be400) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6d6b8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffefff(slab) raw: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000003 ffffea0001b5ae01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5195, tgid 5195 (syz-executor), ts 167068052439, free_ts 167061567274 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468 prep_new_page mm/page_alloc.c:1476 [inline] get_page_from_freelist+0x2e43/0x2f00 mm/page_alloc.c:3420 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4678 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page+0x5f/0x120 mm/slub.c:2265 allocate_slab+0x5a/0x2f0 mm/slub.c:2428 new_slab mm/slub.c:2481 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667 __slab_alloc+0x58/0xa0 mm/slub.c:3757 __slab_alloc_node mm/slub.c:3810 [inline] slab_alloc_node mm/slub.c:3989 [inline] __do_kmalloc_node mm/slub.c:4121 [inline] __kmalloc_noprof+0x257/0x400 mm/slub.c:4135 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] ipt_alloc_initial_table+0x70/0x5b0 net/ipv4/netfilter/ip_tables.c:36 iptable_security_table_init+0x1c/0x70 net/ipv4/netfilter/iptable_security.c:43 xt_find_table_lock+0x2d4/0x3b0 net/netfilter/x_tables.c:1260 xt_request_find_table_lock+0x26/0x100 net/netfilter/x_tables.c:1285 get_info net/ipv4/netfilter/ip_tables.c:963 [inline] do_ipt_get_ctl+0x89e/0x1810 net/ipv4/netfilter/ip_tables.c:1659 nf_getsockopt+0x299/0x2c0 net/netfilter/nf_sockopt.c:116 ip_getsockopt+0x222/0x2e0 net/ipv4/ip_sockglue.c:1777 tcp_getsockopt+0x163/0x1c0 net/ipv4/tcp.c:4409 page last free pid 1004 tgid 1004 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1088 [inline] free_unref_page+0xd22/0xea0 mm/page_alloc.c:2583 __folio_put+0x3b9/0x620 mm/swap.c:129 folio_put include/linux/mm.h:1508 [inline] free_large_kmalloc+0x105/0x1c0 mm/slub.c:4529 kfree+0x1c4/0x360 mm/slub.c:4552 rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1169 ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626 ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x802/0xcc0 net/core/net_namespace.c:640 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffff88806d6bdf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88806d6bdf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88806d6be000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88806d6be080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88806d6be100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in l2tp_session_unhash net/l2tp/l2tp_core.c:1256 [inline] BUG: KASAN: slab-use-after-free in l2tp_session_delete+0x128/0x9e0 net/l2tp/l2tp_core.c:1643 Read of size 8 at addr ffff88806d6be010 by task kworker/u8:7/3671 CPU: 1 PID: 3671 Comm: kworker/u8:7 Not tainted 6.10.0-rc4-syzkaller-00948-gcce346d44139 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: l2tp l2tp_tunnel_del_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 l2tp_session_unhash net/l2tp/l2tp_core.c:1256 [inline] l2tp_session_delete+0x128/0x9e0 net/l2tp/l2tp_core.c:1643 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1302 [inline] l2tp_tunnel_del_work+0x1cb/0x330 net/l2tp/l2tp_core.c:1334 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 5255: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:4122 [inline] __kmalloc_noprof+0x1f9/0x400 mm/slub.c:4135 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] l2tp_session_create+0x3b/0xc20 net/l2tp/l2tp_core.c:1675 pppol2tp_connect+0xca3/0x17a0 net/l2tp/l2tp_ppp.c:782 __sys_connect_file net/socket.c:2049 [inline] __sys_connect+0x2df/0x310 net/socket.c:2066 __do_sys_connect net/socket.c:2076 [inline] __se_sys_connect net/socket.c:2073 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2073 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 25: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2196 [inline] slab_free mm/slub.c:4437 [inline] kfree+0x149/0x360 mm/slub.c:4558 __sk_destruct+0x58/0x5f0 net/core/sock.c:2191 rcu_do_batch kernel/rcu/tree.c:2535 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3072 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176 pppol2tp_release+0x24b/0x350 net/l2tp/l2tp_ppp.c:457 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x406/0x8b0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:180 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88806d6be000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 16 bytes inside of freed 1024-byte region [ffff88806d6be000, ffff88806d6be400) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x6d6b8 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffefff(slab) raw: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000003 ffffea0001b5ae01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5195, tgid 5195 (syz-executor), ts 167068052439, free_ts 167061567274 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468 prep_new_page mm/page_alloc.c:1476 [inline] get_page_from_freelist+0x2e43/0x2f00 mm/page_alloc.c:3420 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4678 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page+0x5f/0x120 mm/slub.c:2265 allocate_slab+0x5a/0x2f0 mm/slub.c:2428 new_slab mm/slub.c:2481 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667 __slab_alloc+0x58/0xa0 mm/slub.c:3757 __slab_alloc_node mm/slub.c:3810 [inline] slab_alloc_node mm/slub.c:3989 [inline] __do_kmalloc_node mm/slub.c:4121 [inline] __kmalloc_noprof+0x257/0x400 mm/slub.c:4135 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] ipt_alloc_initial_table+0x70/0x5b0 net/ipv4/netfilter/ip_tables.c:36 iptable_security_table_init+0x1c/0x70 net/ipv4/netfilter/iptable_security.c:43 xt_find_table_lock+0x2d4/0x3b0 net/netfilter/x_tables.c:1260 xt_request_find_table_lock+0x26/0x100 net/netfilter/x_tables.c:1285 get_info net/ipv4/netfilter/ip_tables.c:963 [inline] do_ipt_get_ctl+0x89e/0x1810 net/ipv4/netfilter/ip_tables.c:1659 nf_getsockopt+0x299/0x2c0 net/netfilter/nf_sockopt.c:116 ip_getsockopt+0x222/0x2e0 net/ipv4/ip_sockglue.c:1777 tcp_getsockopt+0x163/0x1c0 net/ipv4/tcp.c:4409 page last free pid 1004 tgid 1004 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1088 [inline] free_unref_page+0xd22/0xea0 mm/page_alloc.c:2583 __folio_put+0x3b9/0x620 mm/swap.c:129 folio_put include/linux/mm.h:1508 [inline] free_large_kmalloc+0x105/0x1c0 mm/slub.c:4529 kfree+0x1c4/0x360 mm/slub.c:4552 rhashtable_free_and_destroy+0x7c6/0x920 lib/rhashtable.c:1169 ila_xlat_exit_net+0x55/0x110 net/ipv6/ila/ila_xlat.c:626 ops_exit_list net/core/net_namespace.c:173 [inline] cleanup_net+0x802/0xcc0 net/core/net_namespace.c:640 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffff88806d6bdf00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88806d6bdf80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88806d6be000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88806d6be080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88806d6be100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================