Extracting prog: 25m35.599432983s Minimizing prog: 1h31m49.758174071s Simplifying prog options: 5m57.13104844s Extracting C: 2m59.343191841s Simplifying C: 0s extracting reproducer from 83 programs testing a last program of every proc single: executing 33 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r6, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-pipe2$9p-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_ENABLE_BEARER-mount$9p_virtio-socket$inet-getsockopt$inet_opts-keyctl$session_to_parent-keyctl$session_to_parent-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_RESET_LINK_STATS-chdir-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000300), 0x800c0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x34, r1, 0x1, 0x70bd2b, 0x0, {{}, {}, {0x18, 0x17, {0x0, 0xfffffffd, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}}, 0x10) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) r2 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_opts(r2, 0x0, 0x4, 0x0, &(0x7f0000000240)=0x28) keyctl$session_to_parent(0x12) keyctl$session_to_parent(0x12) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x28, r3, 0x100, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x24008841}, 0x20000800) chdir(&(0x7f0000000100)='./file0\x00') rmdir(&(0x7f0000000080)='./file2\x00') program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mkdirat-pipe2$9p-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_ENABLE_BEARER-mount$9p_virtio-socket$inet-getsockopt$inet_opts-keyctl$session_to_parent-keyctl$session_to_parent-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_RESET_LINK_STATS-chdir-rmdir detailed listing: executing program 0: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000300), 0x800c0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x34, r1, 0x1, 0x70bd2b, 0x0, {{}, {}, {0x18, 0x17, {0x0, 0xfffffffd, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}}, 0x10) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) r2 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_opts(r2, 0x0, 0x4, 0x0, &(0x7f0000000240)=0x28) keyctl$session_to_parent(0x12) keyctl$session_to_parent(0x12) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x28, r3, 0x100, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x24008841}, 0x20000800) chdir(&(0x7f0000000100)='./file0\x00') rmdir(&(0x7f0000000080)='./file2\x00') program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r6, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$netlbl_calipso-sendmsg$NLBL_CALIPSO_C_ADD-syz_init_net_socket$nl_generic-sendmsg$NLBL_CALIPSO_C_LISTALL-sendmsg$NET_DM_CMD_START-syz_genetlink_get_family_id$nl802154-syz_genetlink_get_family_id$nl802154-ioctl$sock_SIOCGIFINDEX_802154-ioctl$sock_SIOCGIFINDEX_802154-ioctl$sock_SIOCGIFINDEX_802154-sendmsg$NL802154_CMD_SET_PAN_ID-sendmsg$NL802154_CMD_SET_PAN_ID-sendmsg$NL802154_CMD_GET_SEC_DEV-sendmsg$NL802154_CMD_GET_SEC_DEV-syz_open_procfs$namespace-syz_open_procfs$namespace-ioctl$NS_GET_PARENT-ioctl$NS_GET_PARENT-sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS-sendmsg$NL802154_CMD_GET_SEC_DEV-sendmsg$NLBL_CALIPSO_C_LISTALL-syz_genetlink_get_family_id$ieee802154-sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL-sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH-ioctl$sock_SIOCGIFINDEX_802154-sendmsg$IEEE802154_LLSEC_ADD_DEV-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_TRAP_SET-sendmsg$DEVLINK_CMD_TRAP_SET-socket$nl_generic-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_GET_DEST-syz_genetlink_get_family_id$nl802154-syz_genetlink_get_family_id$nl802154-sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x4, 0x70bd29, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x28080}, 0xe29bb9bfcb0d33fd) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r0, 0x800, 0x70bd28, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbfd, {}, ["", ""]}, 0x14}}, 0x1) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r1) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000400)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000440)={'wpan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000440)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(r1, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r2, 0xb00, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_PAN_ID={0x6, 0x9, 0xfffd}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) sendmsg$NL802154_CMD_SET_PAN_ID(r1, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r2, 0xb00, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_PAN_ID={0x6, 0x9, 0xfffd}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r2, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r2, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000680)='ns/uts\x00') (async) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000680)='ns/uts\x00') ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) (async) r6 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x48, r2, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r5}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x40440a0}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x1c, r2, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000000}, 0x24000091) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4090}, 0x240040c0) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a00), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, r7, 0x1a6eee6dfa759078, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40000) (async) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, r7, 0x1a6eee6dfa759078, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40000) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b40), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000b80)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r8, &(0x7f0000000c40)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r9, 0x200, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x22) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c80)={'wpan1\x00'}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r1, &(0x7f0000000d80)={&(0x7f0000000cc0), 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x20, r7, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c810}, 0x4c0d5) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000e00), r8) sendmsg$DEVLINK_CMD_TRAP_SET(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001040)={&(0x7f0000000e40)={0x1dc, r11, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x4001}, 0x4814) (async) sendmsg$DEVLINK_CMD_TRAP_SET(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001040)={&(0x7f0000000e40)={0x1dc, r11, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x4001}, 0x4814) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001100), r8) sendmsg$IPVS_CMD_GET_DEST(r12, &(0x7f00000012c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001280)={&(0x7f0000001140)={0x12c, r13, 0x2, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x38}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5f}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x37}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xa3a}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3a}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8000}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7fffffff}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x5d}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xa}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x21}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x15}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x18}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x73}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xec3}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x4040880}, 0x20000000) syz_genetlink_get_family_id$nl802154(&(0x7f0000001340), r1) (async) r14 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001340), r1) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000001400)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0xaa6a72ee28759772}, 0xc, &(0x7f00000013c0)={&(0x7f0000001380)={0x20, r14, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x80) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001000000140007000000000003"], 0x74}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$MAP_UPDATE_ELEM-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$inet_udplite-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_IBSS-openat$cgroup_ro-write$binfmt_script-mmap-write$rfkill-setsockopt$ARPT_SO_SET_REPLACE-openat$tun-utime-syz_open_procfs$userns-shmget$private-shmat-shmdt-preadv2-ioctl$NS_GET_OWNER_UID-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-ioctl$TUNSETIFINDEX detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB="01000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, &(0x7f0000000180)="cc2dc08a9b8de89ce8007527f71e7c4ecaeb6eb20a7274a028a2c871eb483e69e6d5a9ae416b", &(0x7f0000000280)=@buf="7b8daea8ba1d2c0ded2260b6369fd4f34b68c496c8a9a2601c5e097c2c8fde771bdb59c0f036cefd07ff25d26d7567a98f6ee81dc5c4f004325c5392f46fc881bdb44854a9fb56c2357f48f2561d49ba4443a319fc25b531ed01accceacc0c2d8aabfc9a123988c021d7e68699f5bbc7c46e5af266fc5121ba5cccb852b5e19e9dae7e1cbff9c3aa501492e7f427d8b8871ec2080f7eb3b2d174a489c0b3446138aa7b8f7442b5", 0x1}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000071"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r3}, 0x10) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)={0x50, r5, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random='n'}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "dba06c8914"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_DEFAULT={0x4}]}]}]}, 0x50}}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000020180)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r8, 0x0) write$rfkill(r8, &(0x7f0000000340)={0x7fff, 0x1, 0x2, 0x1, 0x1}, 0x8) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000500)={'filter\x00', 0x4, 0x4, 0x3e0, 0x0, 0x1f0, 0x1f0, 0x2f8, 0x2f8, 0x2f8, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0x108, 0x0, {0x3ed}}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x20c49a, 'syz0\x00'}}}, {{@arp={@rand_addr, @loopback, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@link_local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'gretap0\x00', 'bridge_slave_0\x00'}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x0, 0x6}}}, {{@arp={@remote, @broadcast, 0x0, 0x0, 0x0, 0x0, {}, {@mac}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_bridge\x00', 'lo\x00'}, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x20c49a, 'syz0\x00'}}}], {{'\x00', 0xc0, 0xe8}, {0x28, '\x00', 0x2}}}}, 0x430) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40800, 0x0) utime(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x2e85dc65, 0xd58}) r10 = syz_open_procfs$userns(0x0, &(0x7f0000000000)) r11 = shmget$private(0x0, 0x3000, 0x54001800, &(0x7f000010d000/0x3000)=nil) r12 = shmat(r11, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffdfff) shmdt(r12) preadv2(r2, &(0x7f0000001f00)=[{&(0x7f0000000940)=""/187, 0xbb}, {&(0x7f0000000a00)=""/4096, 0x1000}, {&(0x7f0000000400)=""/23, 0x17}, {&(0x7f0000001ac0)=""/146, 0x92}, {&(0x7f0000001b80)=""/242, 0xf2}, {&(0x7f0000001c80)=""/143, 0x8f}, {&(0x7f0000001d40)=""/248, 0xf8}, {&(0x7f0000001e40)=""/145, 0x91}, {&(0x7f0000001a00)=""/71, 0x47}], 0x9, 0x6, 0x5, 0x7) ioctl$NS_GET_OWNER_UID(r10, 0xb704, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r9, 0x400454da, &(0x7f0000000080)=r13) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_init_net_socket$bt_l2cap-socket$nl_route-sendmsg$nl_route-connect$bt_l2cap-connect$bt_l2cap-openat$vhost_vsock-socket$nl_route-sendmsg$nl_route-openat$vhost_vsock-ioctl$VHOST_SET_MEM_TABLE-semget$private-semctl$IPC_INFO-mlock-madvise detailed listing: executing program 0: madvise(&(0x7f0000122000/0x4000)=nil, 0x4000, 0x66) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv6_newrule={0x38, 0x18, 0x1, 0x0, 0x0, {0xa, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}, @FRA_SRC={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @none}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000a40)={0x1f, 0xd, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x5}, 0xe) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001900)=ANY=[@ANYBLOB="2c0000041e00010000c3aeba8823bda665e80000", @ANYRES32=0x0, @ANYBLOB="000004000a0002000000000000000000"], 0x28}}, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af25, &(0x7f0000000940)) r4 = semget$private(0x0, 0x4, 0x1) semctl$IPC_INFO(r4, 0x0, 0x3, &(0x7f00000000c0)=""/229) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$netlbl_calipso-sendmsg$NLBL_CALIPSO_C_ADD-syz_init_net_socket$nl_generic-sendmsg$NLBL_CALIPSO_C_LISTALL-sendmsg$NET_DM_CMD_START-syz_genetlink_get_family_id$nl802154-syz_genetlink_get_family_id$nl802154-ioctl$sock_SIOCGIFINDEX_802154-ioctl$sock_SIOCGIFINDEX_802154-ioctl$sock_SIOCGIFINDEX_802154-sendmsg$NL802154_CMD_SET_PAN_ID-sendmsg$NL802154_CMD_SET_PAN_ID-sendmsg$NL802154_CMD_GET_SEC_DEV-sendmsg$NL802154_CMD_GET_SEC_DEV-syz_open_procfs$namespace-syz_open_procfs$namespace-ioctl$NS_GET_PARENT-ioctl$NS_GET_PARENT-sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS-sendmsg$NL802154_CMD_GET_SEC_DEV-sendmsg$NLBL_CALIPSO_C_LISTALL-syz_genetlink_get_family_id$ieee802154-sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL-sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL-socket$nl_generic-socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH-ioctl$sock_SIOCGIFINDEX_802154-sendmsg$IEEE802154_LLSEC_ADD_DEV-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_TRAP_SET-sendmsg$DEVLINK_CMD_TRAP_SET-socket$nl_generic-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_GET_DEST-syz_genetlink_get_family_id$nl802154-syz_genetlink_get_family_id$nl802154-sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x4, 0x70bd29, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x28080}, 0xe29bb9bfcb0d33fd) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r0, 0x800, 0x70bd28, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbfd, {}, ["", ""]}, 0x14}}, 0x1) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r1) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000400)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000440)={'wpan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000440)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(r1, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r2, 0xb00, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_PAN_ID={0x6, 0x9, 0xfffd}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) sendmsg$NL802154_CMD_SET_PAN_ID(r1, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r2, 0xb00, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_PAN_ID={0x6, 0x9, 0xfffd}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r2, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r2, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000680)='ns/uts\x00') (async) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000680)='ns/uts\x00') ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) (async) r6 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x48, r2, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r5}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x40440a0}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x1c, r2, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000000}, 0x24000091) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4090}, 0x240040c0) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a00), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, r7, 0x1a6eee6dfa759078, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40000) (async) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, r7, 0x1a6eee6dfa759078, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40000) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b40), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000b80)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r8, &(0x7f0000000c40)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r9, 0x200, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x22) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c80)={'wpan1\x00'}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r1, &(0x7f0000000d80)={&(0x7f0000000cc0), 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x20, r7, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c810}, 0x4c0d5) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000e00), r8) sendmsg$DEVLINK_CMD_TRAP_SET(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001040)={&(0x7f0000000e40)={0x1dc, r11, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x4001}, 0x4814) (async) sendmsg$DEVLINK_CMD_TRAP_SET(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001040)={&(0x7f0000000e40)={0x1dc, r11, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x4001}, 0x4814) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001100), r8) sendmsg$IPVS_CMD_GET_DEST(r12, &(0x7f00000012c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001280)={&(0x7f0000001140)={0x12c, r13, 0x2, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x38}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5f}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x37}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xa3a}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3a}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8000}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7fffffff}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x5d}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xa}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x21}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x15}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x18}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x73}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xec3}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x4040880}, 0x20000000) syz_genetlink_get_family_id$nl802154(&(0x7f0000001340), r1) (async) r14 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001340), r1) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000001400)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0xaa6a72ee28759772}, 0xc, &(0x7f00000013c0)={&(0x7f0000001380)={0x20, r14, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x80) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001000000140007000000000003"], 0x74}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$MAP_UPDATE_ELEM-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$PROG_LOAD-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$inet_udplite-syz_genetlink_get_family_id$nl80211-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_JOIN_IBSS-openat$cgroup_ro-write$binfmt_script-mmap-write$rfkill-setsockopt$ARPT_SO_SET_REPLACE-openat$tun-utime-syz_open_procfs$userns-shmget$private-shmat-shmdt-preadv2-ioctl$NS_GET_OWNER_UID-ioctl$ifreq_SIOCGIFINDEX_batadv_hard-ioctl$TUNSETIFINDEX detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB="01000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, &(0x7f0000000180)="cc2dc08a9b8de89ce8007527f71e7c4ecaeb6eb20a7274a028a2c871eb483e69e6d5a9ae416b", &(0x7f0000000280)=@buf="7b8daea8ba1d2c0ded2260b6369fd4f34b68c496c8a9a2601c5e097c2c8fde771bdb59c0f036cefd07ff25d26d7567a98f6ee81dc5c4f004325c5392f46fc881bdb44854a9fb56c2357f48f2561d49ba4443a319fc25b531ed01accceacc0c2d8aabfc9a123988c021d7e68699f5bbc7c46e5af266fc5121ba5cccb852b5e19e9dae7e1cbff9c3aa501492e7f427d8b8871ec2080f7eb3b2d174a489c0b3446138aa7b8f7442b5", 0x1}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000071"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r3}, 0x10) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)={0x50, r5, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random='n'}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "dba06c8914"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_DEFAULT={0x4}]}]}]}, 0x50}}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000020180)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r8, 0x0) write$rfkill(r8, &(0x7f0000000340)={0x7fff, 0x1, 0x2, 0x1, 0x1}, 0x8) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000500)={'filter\x00', 0x4, 0x4, 0x3e0, 0x0, 0x1f0, 0x1f0, 0x2f8, 0x2f8, 0x2f8, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0x108, 0x0, {0x3ed}}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x20c49a, 'syz0\x00'}}}, {{@arp={@rand_addr, @loopback, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@link_local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'gretap0\x00', 'bridge_slave_0\x00'}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x0, 0x6}}}, {{@arp={@remote, @broadcast, 0x0, 0x0, 0x0, 0x0, {}, {@mac}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_bridge\x00', 'lo\x00'}, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x20c49a, 'syz0\x00'}}}], {{'\x00', 0xc0, 0xe8}, {0x28, '\x00', 0x2}}}}, 0x430) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40800, 0x0) utime(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x2e85dc65, 0xd58}) r10 = syz_open_procfs$userns(0x0, &(0x7f0000000000)) r11 = shmget$private(0x0, 0x3000, 0x54001800, &(0x7f000010d000/0x3000)=nil) r12 = shmat(r11, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffdfff) shmdt(r12) preadv2(r2, &(0x7f0000001f00)=[{&(0x7f0000000940)=""/187, 0xbb}, {&(0x7f0000000a00)=""/4096, 0x1000}, {&(0x7f0000000400)=""/23, 0x17}, {&(0x7f0000001ac0)=""/146, 0x92}, {&(0x7f0000001b80)=""/242, 0xf2}, {&(0x7f0000001c80)=""/143, 0x8f}, {&(0x7f0000001d40)=""/248, 0xf8}, {&(0x7f0000001e40)=""/145, 0x91}, {&(0x7f0000001a00)=""/71, 0x47}], 0x9, 0x6, 0x5, 0x7) ioctl$NS_GET_OWNER_UID(r10, 0xb704, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r9, 0x400454da, &(0x7f0000000080)=r13) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): madvise-syz_init_net_socket$bt_l2cap-socket$nl_route-sendmsg$nl_route-connect$bt_l2cap-connect$bt_l2cap-openat$vhost_vsock-socket$nl_route-sendmsg$nl_route-openat$vhost_vsock-ioctl$VHOST_SET_MEM_TABLE-semget$private-semctl$IPC_INFO-mlock-madvise detailed listing: executing program 0: madvise(&(0x7f0000122000/0x4000)=nil, 0x4000, 0x66) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv6_newrule={0x38, 0x18, 0x1, 0x0, 0x0, {0xa, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}, @FRA_SRC={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @none}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000a40)={0x1f, 0xd, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x5}, 0xe) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001900)=ANY=[@ANYBLOB="2c0000041e00010000c3aeba8823bda665e80000", @ANYRES32=0x0, @ANYBLOB="000004000a0002000000000000000000"], 0x28}}, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af25, &(0x7f0000000940)) r4 = semget$private(0x0, 0x4, 0x1) semctl$IPC_INFO(r4, 0x0, 0x3, &(0x7f00000000c0)=""/229) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet6_sctp-socket-sendmmsg$inet-socket$inet_sctp-getsockopt$inet_sctp_SCTP_MAX_BURST-setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET-setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS-socket$nl_route-sendmsg$nl_route-bind$inet6-sendto$inet6-sendmmsg$inet6-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_sctp-getsockopt$inet_sctp_SCTP_MAX_BURST-setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM-syz_init_net_socket$bt_sco detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f0000000c80)=[{{&(0x7f0000000040)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000180)="fd", 0x1}], 0x1}}], 0x1, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f00000002c0)={r4, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={r4, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32, 0x4}, 0x9c) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newnexthop={0x38, 0x68, 0x1, 0x100003, 0x80000000, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_UNBALANCED_TIMER={0x8, 0x3, 0x3}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048080}, 0x0) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000004900)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000004c0)="cc", 0x1}, {&(0x7f0000000ac0)="4e9dd319954453cfb964069ecd1e9e57f63f624a199c52d0c71dee297e3cc62907abd41ca061e83e7700876b8f6e5101c3cfc57a91e526f1114f3a24deb15bdc1ae3a4997defba7e8f54671921ca19354ecf9ef4ac40241e6b64006b1384c61f16bf71c22442de77e258c3b4e207d23cc92e7e3dc2263f662c1ff3cb3a0c3c8bb55725268a5c2ab5e56a8c4dcabf68f9752d4e403cefc66d46b3102415fdd39b1b6986be0f8fbc84414f5bf88aa16e962fdbd7bfd639bad83a507096a6e33fa26c296e2a", 0xc4}, {&(0x7f00000009c0)="cbc0d4c6d51135e674dba57d6ed2ddc12056125b0ee224059bbf1f648d3fa32b8c0565f8cf4476f3709c4ed60544b2430349014358210c255a7d8096eb553abab27c0ac83dc82625d4fdb15e93956483c4", 0x51}, {&(0x7f0000000240)="dabd58f0f476e1ee724050b11a34fb50bd7acdf8986a1bae5a6171a631e4ee6ce1fceaf3265694fa6c47559712e4683ebe7eb22cafe9b4e7d4fd9aedc49b9270e7a28fc6c70ca89b44cf10d87455a1c34c9c3671d9cf3a62d0fa1c14e41337b865365d05cab609e6359cadf7f8cb428422e18608aa775f8672b75e064b7634da1e740901cb364157a07b5a46bd94e80e75fd8b4bf6d1f5ea80156c990474115f68c565c5dcd8247d071dea9036be90096250304c76b78f01", 0xb8}, {&(0x7f0000000a40)="aca011498c4ac0b7f827ead24cbde30a1c401d69bbf00e0d63a3490cc9754869c64486b720e5def9cb9affdde4ced0fe0776226ed8745b35977d4fcf442f291dd74e3467a653acd1cfb4efd432d01d610486781db3dcc332f9b252a5507c386aa6", 0x61}, {&(0x7f0000000000)="a8881b4a98f50a234d9d8fbb5ed492ca94dded781eb4c44e84862c0aa48b0f06a53d4f74db01e8b7c8da032a1915704ce1c077b7b2a1c7e22786b38e44189f4e85b3f1073198a6ce8162d89cdce40891c4d362cc5ca5fbb8e660700a538d015988b6815b9d46ccda9e368c1fbc8a389adc0f421f38468a163ba8765e832115f61b042405278bdfba3a79cfda3c8453d2b483b9f872a3492e69e81a", 0x9b}, {&(0x7f00000008c0)="2e8dd0eee2a97f0dd0cbd80505ee0793e2b0aa874c8ffa76d69cbb088bd641c792047e589bd703a6befa1b46e1f895a6255b1d349a431005a1ef67cb6e1e7f5371b51ef8728c5a23f9d7346aa54ca30ffa29712f6463eefd1f2e2e0134c8a1ffca3ea413bb66c82ecbb114b125acf0144df3164d2653d5b616c3c97cc53453fe4cdcf954774147fed45ccbe9592c18848c7e454efed4eb32aaead3731cc9b0086a82133c6b7a4823d9ae42917f192cf0613c4194e4a1d5e3fd3eef855441d7298283f0b175b9af48a846944aa5f2dca16e5236a89f1c1306945bc4b895420b6bc64691cc86566f064f79cc", 0xeb}, {&(0x7f0000000440)="47b3be7a75f09a20302a26df27d2efe74c6c022a3dbe537ab15d7cca1666e8397decf681f573dfe4399c8a797453a8350817fea1b2adc9963a0a07e373fad1322102d75deb3bb93403a49fea1c5463fa1ced34db2bbf4a", 0x57}, {&(0x7f0000001080)="1fc09a390764166802fb41e3732a9f21408e5f97c1b811ed3f34f2dcab80f127ba1b74bf21ca369777b9faf02771a5b31ec9111c36b14c308ba794002caad7ab2361476fa0d269ca75210901fce82996dbd9a76cbd0085fbca35b49b5ee88cb23740f668fdebca91a7c153c170e0929c5de8c56f49e51f2e4700bcd34b355c18203a80ddfd60f478ff48c257c597c30c232924b05e5119acdcf61372a43bcfca60bce159dcd9077ba57b630d279859b236073a163de3b39e20fdc8428afde11d4ff26477b6ee9830d9a1c8aae982bb0c83f4f3adc685ddae903a9e4023f63f4f3bac3ff366a950b997116160ce22558ad42e43580512438c9e11e6f6b8ac6407407d9c39aa609d8c267a907228a5ca6111b405f09bdcafbc3bfb7e52c2633fd20e969348ef08117259acc953652a7a988a461a5629906c1a36482b5f2d784fd926c50c83f92117950a8551da6cc69351dd7d117719253dd2c041686e99577a92894456377f0c0458afaa0275206b4678abbbe6bd852392a24360f1adbd742b0d712d9318a9d93b2d5ef49e5de7cd5f0d35ccaf9676725fba524086131108d168a1952d626a5ef80bfc0b340262faa8d6fcec328d690266a84557a155943dc893813984909ac41adf60e8fdb7fe7645c9d7f6d5e14d603bd12dc90e5d752b7fb2c9990b2bc123729f293752509f575e4577c068f446c11fc53fb25c9f97076a5121618f72b04cc5020714028017e9d68be767508c21f7cc9fb76439e4edd903472b271bed2a19c9a53d306f5d36fc00ca4b82e93b7ef81f0f140c5993e9a035817bfe41ec894b9244772284e493311cefc4431a6f7e160e4c7035459c554bc5b31177b618db308d3fce0124db993979ba20e9db17f090fa438ca187adf5129301931f7a0787bcba095b3d50181f62284ad68349c9c9f50ac7d5f3f5cb08be78826f7c3c5068df3cd4db5c4283fb3b9ead414801ea63f059c340b0a693eaeeaddf17f3542f7933930e6a9918123526d9267b46a9cd76baf361df1cbc49ed5b8f650457d4d24142d83b1aef21d4f43837a2dced49697cdbcf4e963caaf68b6f22be01591a45ce4e3cc541a2c08338f0baa1585b78cd5564ebe500cf578c7ef806267d4bde067bba28a5417f0f2366a9e5873b1ed5e27307c75ae0dc719254764c3c778b7650e5cfb1b721766d28b53e2b09b0bf5747fecdd731555e183c91", 0x35d}], 0x9}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000500)="bda033176eb146b36ef41f221a4e7ce48b2598d750606488520915c6806affc0a913781c7211ce1fcd59a12b5d5afdaf9d723f092ce9d1eed16e208f2e79831ca049e8979ad94621175c2c48c10e33b29f2def51498743b057efc21efe4be4e5f02e9d236f27190c29c5da0f3799452f5e3640340502fde4ae8c56b303e1b79b3d1842bf6277771bef544c745e7a80c9e7efdd1c619f69b9d01839aa326776d335689e4db7cb7e32fad8f4c40e943b43eb4ea173d720bf5998149625a731643636c8ddbe61e1d7d4736f8414a84acc40557012c82697d8a59c873424aefb3c7ff0dba302efaaf887a477b1ab7ea6c1def9db3514e444c1ef36c6cf42cde90d4bbb2e9a3a5d16a1bb191ad91cab867cd55037d507a12803f3df1b81f1857fad085dbc5c46aac14230d7a4f8b36d6bc63b4a16cd309b7697b421a662b83001b5ce5ab3ff80800243107df7aa6cae9a5db6a8f2a53ef7d6c6aeac76b83a15466c74a9cdbcde8505e3d14c0c3a47a36bf464168202dc88e25f4c1da57faf0eaa7ff16bdd751c2ae5778e169c8ffba57c9a20e24ad51e6e8e02b721e8ca94f131cc98e03b34b615a1db4080362de4ef215d5a0541aeb0c742a2636ac5af8538ceb3585ef9dca8037df55baa072096073b005b53eff0b899de59bc2b5d687d109520571eeacb30124c4012fe6cb9e3bf451be3d219206ddc35099101533cff5aee6c4783e00e6dd391f664052a6c66c62f62a49fde8fbe336543bf99b55e53b801e54c1d0a292da83db26a8a870ac1d8751c4bc0d495277295cd3a17f9e9a25d70214a17b981b62d5c75356ed025df3557a8b59648edd9d1dbdf169d91f9d85cfac11a57db0a14d33e8934a2cc98d389912a0d9942a40c3ee98d35da61d3bab1a32c9d788e9f74ee57012ca5bfd0dc090b591c64aae6a205fbd349fc372bbd7429983a69cae26ff8b5b019144d318ba225e46bc6cf8d7d3e5952333042542b2fd4fb4d88a3651dd8e14ecc2845d4e71f7dfd128e9e2ee2ab0062a3e701bb2477bfd73d7396ae522f11fa481078d1c7f7905e0846fb072dcf7c06102b3816ec4a3518514c7166d7385b680469f5184a93953258952554e68d93ea8f789c4f13982b65996d7d9cf19f0b39b72e1dc9079d84413bbc30d24fc481e24ef1beac020000000000000084d16a1c71b2c8a568481f4f1b254ccd66fbef4cacfc3e13f2c943a264e429824bef7297f93076aea55ed9cf12512c14ac3df331695024bd1e53369a87caf6894fce81594b43cb3dee05ab21", 0x38f}, {&(0x7f0000000300)="d8fe61cb28d9640d540c44cf98f32ab0975835e26ef8b3d434cb3d6fe6191cf7cb16c54970bbd8ce2b339ed8ca4fea5342c2bdc0f51e90ab1f8e28a1d04977ef48b42de3bbdfa152333d297fbeec0cbb4cf252eb909a27a5d47c0e37822213b2ea5789c033a030fda0d90c1f0dbddf59744cb991868d839bf7d800421e54", 0x7e}], 0x2}}], 0x2, 0x4048884) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000180)=0x10) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x4400, 0x2, 0x0, 0xa55, 0x3, 0xfff, 0x1, r7}, 0x20) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-syz_open_dev$sg-ioctl$SG_IO-ioctl$sock_inet_SIOCSIFADDR detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000140)={0x53, 0xfffffffffffffffb, 0x0, 0x1, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x22000003, 0x10011, 0x1, 0x0}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-ioctl$SIOCSIFMTU-syz_open_dev$sndmidi-mount$9p_virtio-chdir-syz_init_net_socket$ax25-getsockopt$ax25_int-openat$cgroup_ro-mmap-write$vhost_msg_v2-socketpair$unix-dup-write$6lowpan_enable-syz_io_uring_setup-getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000b40)={'dummy0\x00'}) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x40, &(0x7f0000000840)=ANY=[@ANYBLOB="78226e6f65786163638173733d616e792c63616368653d66736361636865"]) (async) chdir(&(0x7f0000000100)='./file0\x00') (async) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x2) getsockopt$ax25_int(r2, 0x101, 0x9, &(0x7f00000001c0), &(0x7f0000000000)=0x4) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='pids.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x4000) (async) write$vhost_msg_v2(r3, &(0x7f00000003c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x3}}, 0x48) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r4 = dup(r1) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) (async) syz_io_uring_setup(0x23a, &(0x7f00000002c0)={0x0, 0x4535, 0x10100, 0x7, 0x0, 0x0, r4}, &(0x7f0000000080), &(0x7f0000000480)) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r4, 0x84, 0x1c, &(0x7f00000000c0), &(0x7f0000000140)=0x4) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$nullb-openat$tun-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun-dup-mmap-madvise-ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-syz_open_procfs-read$FUSE-write$binfmt_aout-madvise-syz_init_net_socket$bt_hci-bind$bt_hci-recvmmsg-setsockopt$sock_int-socket$nl_route-sendmsg$nl_route-write$binfmt_misc-getsockopt$inet_IP_XFRM_POLICY-ioctl$sock_inet6_SIOCDELRT-mount$9p_fd detailed listing: executing program 0: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000024303, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="000086dd0000120000000000000060ec97000f982c00fb8000000000000000000000000000aaff02000000000000000000000000000129"], 0xfce) r3 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r3, 0xc018937e, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0/file0\x00'}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="600000000206010100000000000000000000000005000100070000000900020073797a3000000000140007800800124000050000080008400000000012000300686173683a6e65742c706f72740000000500050002040000050004"], 0x60}, 0x1, 0x0, 0x0, 0x10000}, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mounts\x00') read$FUSE(r5, &(0x7f0000000980)={0x2020}, 0x2020) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x49) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) recvmmsg(r6, &(0x7f0000001840)=[{{0x0, 0x0, 0x0}, 0x1ff}], 0x1, 0x40002000, 0x0) setsockopt$sock_int(r6, 0x1, 0x23, &(0x7f0000000200)=0x5, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={&(0x7f00000018c0)=@ipv6_getroute={0x2c, 0x1a, 0x1, 0x0, 0x0, {}, [@RTA_UID={0x8}, @RTA_MARK={0x8}]}, 0x2c}}, 0x0) write$binfmt_misc(r6, &(0x7f0000000300), 0x6) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@mcast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@empty}}, &(0x7f00000001c0)=0xe8) ioctl$sock_inet6_SIOCDELRT(r5, 0x890c, &(0x7f0000000300)={@mcast1, @empty, @private1, 0xfffffffd, 0x10, 0x4455, 0x500, 0x4, 0x100, r8}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x200042, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@uname={'uname', 0x3d, '/dev/nullb0\x00'}}], [{@dont_measure}, {@dont_hash}, {@euid_eq={'euid', 0x3d, r9}}, {@seclabel}]}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-syz_open_dev$sg-ioctl$SG_IO-ioctl$sock_inet_SIOCSIFADDR detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000140)={0x53, 0xfffffffffffffffb, 0x0, 0x1, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x22000003, 0x10011, 0x1, 0x0}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-ioctl$SIOCSIFMTU-syz_open_dev$sndmidi-mount$9p_virtio-chdir-syz_init_net_socket$ax25-getsockopt$ax25_int-openat$cgroup_ro-mmap-write$vhost_msg_v2-socketpair$unix-dup-write$6lowpan_enable-syz_io_uring_setup-getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000b40)={'dummy0\x00'}) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x40, &(0x7f0000000840)=ANY=[@ANYBLOB="78226e6f65786163638173733d616e792c63616368653d66736361636865"]) (async) chdir(&(0x7f0000000100)='./file0\x00') (async) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x2) getsockopt$ax25_int(r2, 0x101, 0x9, &(0x7f00000001c0), &(0x7f0000000000)=0x4) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='pids.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x4000) (async) write$vhost_msg_v2(r3, &(0x7f00000003c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x3}}, 0x48) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r4 = dup(r1) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) (async) syz_io_uring_setup(0x23a, &(0x7f00000002c0)={0x0, 0x4535, 0x10100, 0x7, 0x0, 0x0, r4}, &(0x7f0000000080), &(0x7f0000000480)) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r4, 0x84, 0x1c, &(0x7f00000000c0), &(0x7f0000000140)=0x4) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-socket$inet6_sctp-socket-sendmmsg$inet-socket$inet_sctp-getsockopt$inet_sctp_SCTP_MAX_BURST-setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET-setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS-socket$nl_route-sendmsg$nl_route-bind$inet6-sendto$inet6-sendmmsg$inet6-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-socket$inet_sctp-getsockopt$inet_sctp_SCTP_MAX_BURST-setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM-syz_init_net_socket$bt_sco detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f0000000c80)=[{{&(0x7f0000000040)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000180)="fd", 0x1}], 0x1}}], 0x1, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f00000002c0)={r4, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={r4, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32, 0x4}, 0x9c) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newnexthop={0x38, 0x68, 0x1, 0x100003, 0x80000000, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_UNBALANCED_TIMER={0x8, 0x3, 0x3}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048080}, 0x0) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000004900)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000004c0)="cc", 0x1}, {&(0x7f0000000ac0)="4e9dd319954453cfb964069ecd1e9e57f63f624a199c52d0c71dee297e3cc62907abd41ca061e83e7700876b8f6e5101c3cfc57a91e526f1114f3a24deb15bdc1ae3a4997defba7e8f54671921ca19354ecf9ef4ac40241e6b64006b1384c61f16bf71c22442de77e258c3b4e207d23cc92e7e3dc2263f662c1ff3cb3a0c3c8bb55725268a5c2ab5e56a8c4dcabf68f9752d4e403cefc66d46b3102415fdd39b1b6986be0f8fbc84414f5bf88aa16e962fdbd7bfd639bad83a507096a6e33fa26c296e2a", 0xc4}, {&(0x7f00000009c0)="cbc0d4c6d51135e674dba57d6ed2ddc12056125b0ee224059bbf1f648d3fa32b8c0565f8cf4476f3709c4ed60544b2430349014358210c255a7d8096eb553abab27c0ac83dc82625d4fdb15e93956483c4", 0x51}, {&(0x7f0000000240)="dabd58f0f476e1ee724050b11a34fb50bd7acdf8986a1bae5a6171a631e4ee6ce1fceaf3265694fa6c47559712e4683ebe7eb22cafe9b4e7d4fd9aedc49b9270e7a28fc6c70ca89b44cf10d87455a1c34c9c3671d9cf3a62d0fa1c14e41337b865365d05cab609e6359cadf7f8cb428422e18608aa775f8672b75e064b7634da1e740901cb364157a07b5a46bd94e80e75fd8b4bf6d1f5ea80156c990474115f68c565c5dcd8247d071dea9036be90096250304c76b78f01", 0xb8}, {&(0x7f0000000a40)="aca011498c4ac0b7f827ead24cbde30a1c401d69bbf00e0d63a3490cc9754869c64486b720e5def9cb9affdde4ced0fe0776226ed8745b35977d4fcf442f291dd74e3467a653acd1cfb4efd432d01d610486781db3dcc332f9b252a5507c386aa6", 0x61}, {&(0x7f0000000000)="a8881b4a98f50a234d9d8fbb5ed492ca94dded781eb4c44e84862c0aa48b0f06a53d4f74db01e8b7c8da032a1915704ce1c077b7b2a1c7e22786b38e44189f4e85b3f1073198a6ce8162d89cdce40891c4d362cc5ca5fbb8e660700a538d015988b6815b9d46ccda9e368c1fbc8a389adc0f421f38468a163ba8765e832115f61b042405278bdfba3a79cfda3c8453d2b483b9f872a3492e69e81a", 0x9b}, {&(0x7f00000008c0)="2e8dd0eee2a97f0dd0cbd80505ee0793e2b0aa874c8ffa76d69cbb088bd641c792047e589bd703a6befa1b46e1f895a6255b1d349a431005a1ef67cb6e1e7f5371b51ef8728c5a23f9d7346aa54ca30ffa29712f6463eefd1f2e2e0134c8a1ffca3ea413bb66c82ecbb114b125acf0144df3164d2653d5b616c3c97cc53453fe4cdcf954774147fed45ccbe9592c18848c7e454efed4eb32aaead3731cc9b0086a82133c6b7a4823d9ae42917f192cf0613c4194e4a1d5e3fd3eef855441d7298283f0b175b9af48a846944aa5f2dca16e5236a89f1c1306945bc4b895420b6bc64691cc86566f064f79cc", 0xeb}, {&(0x7f0000000440)="47b3be7a75f09a20302a26df27d2efe74c6c022a3dbe537ab15d7cca1666e8397decf681f573dfe4399c8a797453a8350817fea1b2adc9963a0a07e373fad1322102d75deb3bb93403a49fea1c5463fa1ced34db2bbf4a", 0x57}, {&(0x7f0000001080)="1fc09a390764166802fb41e3732a9f21408e5f97c1b811ed3f34f2dcab80f127ba1b74bf21ca369777b9faf02771a5b31ec9111c36b14c308ba794002caad7ab2361476fa0d269ca75210901fce82996dbd9a76cbd0085fbca35b49b5ee88cb23740f668fdebca91a7c153c170e0929c5de8c56f49e51f2e4700bcd34b355c18203a80ddfd60f478ff48c257c597c30c232924b05e5119acdcf61372a43bcfca60bce159dcd9077ba57b630d279859b236073a163de3b39e20fdc8428afde11d4ff26477b6ee9830d9a1c8aae982bb0c83f4f3adc685ddae903a9e4023f63f4f3bac3ff366a950b997116160ce22558ad42e43580512438c9e11e6f6b8ac6407407d9c39aa609d8c267a907228a5ca6111b405f09bdcafbc3bfb7e52c2633fd20e969348ef08117259acc953652a7a988a461a5629906c1a36482b5f2d784fd926c50c83f92117950a8551da6cc69351dd7d117719253dd2c041686e99577a92894456377f0c0458afaa0275206b4678abbbe6bd852392a24360f1adbd742b0d712d9318a9d93b2d5ef49e5de7cd5f0d35ccaf9676725fba524086131108d168a1952d626a5ef80bfc0b340262faa8d6fcec328d690266a84557a155943dc893813984909ac41adf60e8fdb7fe7645c9d7f6d5e14d603bd12dc90e5d752b7fb2c9990b2bc123729f293752509f575e4577c068f446c11fc53fb25c9f97076a5121618f72b04cc5020714028017e9d68be767508c21f7cc9fb76439e4edd903472b271bed2a19c9a53d306f5d36fc00ca4b82e93b7ef81f0f140c5993e9a035817bfe41ec894b9244772284e493311cefc4431a6f7e160e4c7035459c554bc5b31177b618db308d3fce0124db993979ba20e9db17f090fa438ca187adf5129301931f7a0787bcba095b3d50181f62284ad68349c9c9f50ac7d5f3f5cb08be78826f7c3c5068df3cd4db5c4283fb3b9ead414801ea63f059c340b0a693eaeeaddf17f3542f7933930e6a9918123526d9267b46a9cd76baf361df1cbc49ed5b8f650457d4d24142d83b1aef21d4f43837a2dced49697cdbcf4e963caaf68b6f22be01591a45ce4e3cc541a2c08338f0baa1585b78cd5564ebe500cf578c7ef806267d4bde067bba28a5417f0f2366a9e5873b1ed5e27307c75ae0dc719254764c3c778b7650e5cfb1b721766d28b53e2b09b0bf5747fecdd731555e183c91", 0x35d}], 0x9}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000500)="bda033176eb146b36ef41f221a4e7ce48b2598d750606488520915c6806affc0a913781c7211ce1fcd59a12b5d5afdaf9d723f092ce9d1eed16e208f2e79831ca049e8979ad94621175c2c48c10e33b29f2def51498743b057efc21efe4be4e5f02e9d236f27190c29c5da0f3799452f5e3640340502fde4ae8c56b303e1b79b3d1842bf6277771bef544c745e7a80c9e7efdd1c619f69b9d01839aa326776d335689e4db7cb7e32fad8f4c40e943b43eb4ea173d720bf5998149625a731643636c8ddbe61e1d7d4736f8414a84acc40557012c82697d8a59c873424aefb3c7ff0dba302efaaf887a477b1ab7ea6c1def9db3514e444c1ef36c6cf42cde90d4bbb2e9a3a5d16a1bb191ad91cab867cd55037d507a12803f3df1b81f1857fad085dbc5c46aac14230d7a4f8b36d6bc63b4a16cd309b7697b421a662b83001b5ce5ab3ff80800243107df7aa6cae9a5db6a8f2a53ef7d6c6aeac76b83a15466c74a9cdbcde8505e3d14c0c3a47a36bf464168202dc88e25f4c1da57faf0eaa7ff16bdd751c2ae5778e169c8ffba57c9a20e24ad51e6e8e02b721e8ca94f131cc98e03b34b615a1db4080362de4ef215d5a0541aeb0c742a2636ac5af8538ceb3585ef9dca8037df55baa072096073b005b53eff0b899de59bc2b5d687d109520571eeacb30124c4012fe6cb9e3bf451be3d219206ddc35099101533cff5aee6c4783e00e6dd391f664052a6c66c62f62a49fde8fbe336543bf99b55e53b801e54c1d0a292da83db26a8a870ac1d8751c4bc0d495277295cd3a17f9e9a25d70214a17b981b62d5c75356ed025df3557a8b59648edd9d1dbdf169d91f9d85cfac11a57db0a14d33e8934a2cc98d389912a0d9942a40c3ee98d35da61d3bab1a32c9d788e9f74ee57012ca5bfd0dc090b591c64aae6a205fbd349fc372bbd7429983a69cae26ff8b5b019144d318ba225e46bc6cf8d7d3e5952333042542b2fd4fb4d88a3651dd8e14ecc2845d4e71f7dfd128e9e2ee2ab0062a3e701bb2477bfd73d7396ae522f11fa481078d1c7f7905e0846fb072dcf7c06102b3816ec4a3518514c7166d7385b680469f5184a93953258952554e68d93ea8f789c4f13982b65996d7d9cf19f0b39b72e1dc9079d84413bbc30d24fc481e24ef1beac020000000000000084d16a1c71b2c8a568481f4f1b254ccd66fbef4cacfc3e13f2c943a264e429824bef7297f93076aea55ed9cf12512c14ac3df331695024bd1e53369a87caf6894fce81594b43cb3dee05ab21", 0x38f}, {&(0x7f0000000300)="d8fe61cb28d9640d540c44cf98f32ab0975835e26ef8b3d434cb3d6fe6191cf7cb16c54970bbd8ce2b339ed8ca4fea5342c2bdc0f51e90ab1f8e28a1d04977ef48b42de3bbdfa152333d297fbeec0cbb4cf252eb909a27a5d47c0e37822213b2ea5789c033a030fda0d90c1f0dbddf59744cb991868d839bf7d800421e54", 0x7e}], 0x2}}], 0x2, 0x4048884) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000180)=0x10) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x4400, 0x2, 0x0, 0xa55, 0x3, 0xfff, 0x1, r7}, 0x20) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER-ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x2002) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f00000000c0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r0, 0xc02064cc, &(0x7f0000000040)={r1, r1, 0x4, 0x3, 0x2}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r0, 0xc02064cc, &(0x7f00000001c0)={r1, r1, 0x0, 0x80000001, 0x2}) (async, rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000080)={0x0}) (rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000180)={&(0x7f0000000140)=[r1, r1, r2, r3, r1, r1, r1, r1], &(0x7f0000000200)=[0x4, 0xd2fd, 0x1000, 0x46, 0x2, 0x101, 0x1, 0xb4, 0x0, 0xbc2], 0x8, 0x1}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$netlink-socket-sendmsg$nl_route_sched-getsockname$packet-sendmsg$nl_route-socket$nl_route-socket-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc0000fffe000000000000000000000008000a00", @ANYRES32=r5], 0x54}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_open_dev$dri-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER-ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER-ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD-ioctl$DRM_IOCTL_SYNCOBJ_CREATE-ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL detailed listing: executing program 0: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x2002) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f00000000c0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r0, 0xc02064cc, &(0x7f0000000040)={r1, r1, 0x4, 0x3, 0x2}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r0, 0xc02064cc, &(0x7f00000001c0)={r1, r1, 0x0, 0x80000001, 0x2}) (async, rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000080)={0x0}) (rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000180)={&(0x7f0000000140)=[r1, r1, r2, r3, r1, r1, r1, r1], &(0x7f0000000200)=[0x4, 0xd2fd, 0x1000, 0x46, 0x2, 0x101, 0x1, 0xb4, 0x0, 0xbc2], 0x8, 0x1}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$can_bcm-ioctl$ifreq_SIOCGIFINDEX_vcan-connect$can_bcm-socket$can_j1939-ioctl$ifreq_SIOCGIFINDEX_vcan-sendmsg$can_j1939-socket$rxrpc-getsockopt-sendmsg$can_bcm-openat$qrtrtun-ppoll-seccomp$SECCOMP_SET_MODE_FILTER_LISTENER-close_range-add_key$keyring-add_key$keyring-pipe2$watch_queue-keyctl$KEYCTL_WATCH_KEY-keyctl$unlink-socket$unix-bind$unix-listen-mount$9p_unix detailed listing: executing program 0: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) sendmsg$can_j1939(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x1d, r3, 0x3, {0x2, 0x1, 0x4}, 0x2}, 0x18, &(0x7f00000001c0)={&(0x7f0000000480)="05f979c4f8fc48825a85022427d79b93f9990cb87d72d6a57525cc551a5e906b8117563a22985ac982da3747a7a8e42b6d9c52d76d8aff240562237d85c34480de1fc6dc1895681a75152d3a077f576e8dd1ed45627507874f03c708e898add617c59d9eb0d4db40d281ae556b2c5f6fa02fa52f0c267af0f4219df1548c1a65ab5ea21a5a58cd5ee2c95c43f54707b6b7e061ba9a99ad3c50e081023e4372484b0b7384d58e2c10fa3b56f0635d342abdbcaa52c6303709d2610a6338b0b7a9bf21d83ef25ebabefc1889608dc0c7e0", 0xd0}, 0x1, 0x0, 0x0, 0x4000001}, 0x8005) r4 = socket$rxrpc(0x21, 0x2, 0x2) getsockopt(r4, 0x110, 0x6, 0x0, &(0x7f0000000280)=0x51) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=r0, @ANYRES64=0x0, @ANYRES64=r1, @ANYBLOB="3ba930b9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40080}, 0x0) r5 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000009c0), 0x0) ppoll(&(0x7f0000000a00)=[{r5, 0x8010}], 0x1, &(0x7f0000000a80)={0x0, 0x3938700}, 0x0, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r8 = add_key$keyring(&(0x7f00000003c0), &(0x7f0000000400)={'syz', 0x2}, 0x0, 0x0, r7) pipe2$watch_queue(&(0x7f0000000440)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r7, r9, 0xf4) keyctl$unlink(0x9, r8, r7) r10 = socket$unix(0x1, 0x1, 0x0) bind$unix(r10, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r10, 0x0) mount$9p_unix(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000100), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=unix']) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_SET_COALESCE-openat-write$binfmt_elf64-close-execveat detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f00000003c0)={0x10a8, r1, 0x1, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xd}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x1}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x105c, 0x3, 0x0, 0x1, [{0x1008, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0x1004, 0x2, "bbf9e5be1ff44d8c120bf2eef57449b359d7ad92cd80ec23fac8eec7fc81d567f06b7366d73aa855b1ee69595fef6ef55c07a5aa1e950991bcde812e198b3e8e0bac19a9dc68a9b310e437c154de7e243dea3a09bbed1d267b7c72e5217cd242cdb54423de60279650e4a5c5dae320443c8d5be8ee4e43d7a282e48729f85fdc5666353b26aa92f1e5069ab2d74115357357f91ed8a74b50a49fdb93796cb2dc373e7d309accc5eb6a7ba007f79ad2628f2aa525d8b63511213191bf0ec427a71ecec6db4faa3de240bd67d32be9eecce9cecdbe8f77430347978d531900eba4e00fd439e679d75af171b7ff93d39cae6599b7a83c1d0251da5f637779e8b5c4f21734176d48521e5e039bfa3262289a22a5982f6ebece51c0589d400e5394b82c79aa31390ba8a0974f4f93cf37503ffa1df7660dc95ea029b455dd5ce645cc82862059b5d6545e0b038a6086821c59df08cf0224c2e8f9e9a973f34b59281d253ca93f9f8e235f10540527193304b8ec4a1a093c3134a926cd391269b652b988e2b64793f4c1713c7b7063ee1cbd9fd86bd9c2bb6f8433030439e917499036ddac24883698158cf1080217dc45ac2110b7491457a9c39f97bd2a7f15316c644592bb6459e534c722f230a21f7a6bbd2ecb9828c853344189fa0b877dd38da176c7cced4d5f5a1d96ec84a26eff9e9b67ccb3b6826e6fd9e6de845ac75354fadab6323dea57b3154e0d1a900f84eb5b1864605066b263fcda559b33b5103fb9e8ed91b837b5571d986be9c6da4288e600b8891a857644df9c7c17ab213de56fa1c2d464c32469b55e896f66ec07225b86aaeb1f578911d21c31f62517396bd853c5c6eef7714ffa04db986867950c82f4d2cf76c08cb21e27fe1c01a8ef9af52360b0f144e586e6988f269801d7acafc12d8dd5dc9c857e4fbdaa8aef2daac84bf215b52a652394173bc58dc7966dcd2018b5df7553bf910863ed2494af8779d754db28757e3f14833d8205633575a8f1a07aa9b29dbdd749077a5a9a7e56c2236306bed25b441a4724ade2c9930800f970e5a49599affebd727ffe0f20dcd5dae5fd4e834859da5586e57cf49ab6e42480db0bf41f68d546dfcc2855372c0929df3faffba494a4ba4228c61ca3dc2888b5ab21307bb99fb425be02c6c5e668f6d5f170935dd13650547bab7ebdec4a08586b1081c6764314c101e94fa1cc1472bac25867a9a770d6b82b298740d38d7debf535adc6c30f53a21ba6bcfc4d39fc9f040881682c4a6e7792ec39f92e95121bc6bebba285af9aee6d827f47a32f35e28742ab31fb9181da1e310c0c868ad11bf43977135e0c3d8b2f11e6f0b3920ac958546e99b2cfe60e8b0657986774c4f25e1759a92866e1bd50ebbbb5effd8ba8e80e9e730ff953ba6b6876571e2f2dfc25c22e568e481e810dc42b59c9e6ac1ef81b3dab25a007bf8a5c43bc42ec8d23fa54f747e7f0977f06fbad61fefb76e0e434f029e68bc87781eba2c0f45ad5c20708032fe51e9ec5c9a69aaa4553f054a3f9818a984f8b39c82d0265614e35aa8c73de0336b814d5ae43ffd3b7c6003a96566735dbc4502e51106e3afde579d20a280bcba682c571ece13ac7fabb7b0fa32dea05e35b7b3c68f6e945e34ef186ba897fc648c8c68522b3291e68d058e67f89e32458e3390a54598aa1a22ad92101dfccbc0418c278ff356a78e4d950970aecabc60e62e7d5f497a6f372a865da4019e120b7d9ce020f34f6f28e8bd475e4a2fce08fc0f6075551c36765b02b197dc5ab24f15fb6fd445a9621206a2142b1502752eaa683e40ed55b9927eaff62fd6e6ffc3c2e04f4e41e0bcb361a41684c6fd3375b6b2e19856930230af09cf18a97d1ae01309242d11b6af98217bddc81da6347492d424ba8923aa2ab3fc4d5f93993308955c20b37d84dde3b3b3332f810bb37dd8b3ffa52a3deb5b7dc47db468a75d00a21a31d56a6489a4427c4b98206cda06f60c4ee38088417ef82712731d4a8a3a49881393f2ebbd0add924e3f64de750fc991d4231a07016687129c4f7015059686ca53af3a3fa57b614e49c7a6988742ddad1eea187753e0562c446cdb7b36ed66104037cb193f42d6f4869e2c1810d6b265160ef482e2587a0a79b339f45828f2aae648ad49967979a93b35b29f7a6b57339d42f51661cacf185167c2963865e2832b2f5f4c60f2c31b457b76c0822cc233c90fb3cb7733ffa0c9f80a519fc9e3d287e05401f2021959985ff280ae0a754eafdab48738828b014e39eaf30f28f68ae500fd4ec0389585dbcf136e4b8d190154c677a9590cbc85f2d87f057a328750b45f50004ddb02ebd2c1036b45c5bd2992508f9673cf419e9cbc18535b2be0e268e94d2b2ca6adfd71521b25f41f32fd1496641941d1ee384b157d4511d09116ecc85307428dd69acbf1a5f362b1eb89af74b62def83c2fe7efc585352ef6f24bbdcfdb4e70f981726874b8bc97c9519e6df965f776431ef502f36288c9d631ab7314186797f5e087272516c39d66c93503bd15763b9170bc959228e6fbbf78eb390a99c94bf5fd898f0328f072e846fe264a9ce839b8910cf570988dbffc9b264cc5f22e45ff146ff1427c85a9bc94457dd0c9a884d14cae174aaa4cfc405e522e58416a93f24af2c533c6021b99134cbc266b6d13ee88ba5a2b613321e6d685fa6b7346cbab0c31ab9d5a28b20e568f91af26230ece4d1f47c3e2e5b58cee156a4173f2e954b2f66aa625cd7fdf0159cf21cf755e092fb5d04eb4e3e897b63a0822b420cf5852157dc1130c2fa9480bc07064e52b052444f24a8f2f404dc2d6f19e93fc221f00e869f59225a58fbbe083c554f23ef26ba8a33c1c5c602f4a8bdd9bb536a4506801ec50dab38463f473dd14842fcf081ea47e2875702b0a0b0329a7b86c2c50750d36ff1b9c13d590668dc180d7cfaeb9435646b697c7d3ed497ad8dd9115a800fbeeb6f2a6f8e64dfc1595f317b6e5a6afa39088ff15d46bf8d05269303f1f64000a404151026f7933817fbf5d168477606fef974d6044cbc642b1ec7a9a45a3df72c7338300442367813622e686c6b7acb150b656c6ef36d594d2cf4744a467d21f6fcec38c0976ebc0b2b4fb1b9a6896951ad6185de88d5269a30ed3feb666eba707336cb579ac03a283b745eb97b87f9c6d18b634a4b58d01c17541965ac2505529feeb8a13e6e7deea05cff13c08ccaaef2b44e4b3b64a7555781e5d1eca80c9569c5e50900094f21e30d25488d41959c1a2f8bc95d1c0f90d88ad0c38b4debedd5ea08ee4a4024e8b85b0a85b3764d2bc344a9306204d356910f0d1502022b80e034d6118715a43e0cf54d4349d03ef513fbc7c2992c0102efc8a0c966dcdd4b9532565de096fb6e5c8a5c2b0dbf99232273c117a5bb33d1b480b53130d066398e00935a642f210de9925322b5198500a54f37f9b6a6f2c736567e69a35a9ef2ed65f135b35b3a65e7a541891537e1ccabccb03eb5ca543021c47ed658c2eca5b1cf2b270354a78d41121c18670c117083b54538bffa76e15c983f0f8c8631df796cbc48b33463d28e4840fe37a0914380eb4777829502851ddef24a4327372d0bcaa24e50d856c44cad7288cd49bcf7e3985f506cb09b7a73eff2ba69d51db6ccdd1a204a192305df2b3b3317da6294e0c9fed50ba96a0e188a8cfa944a15964e1dad94fe6a4138a5b4ee33df9c45ed56b637daca44ef6f81674a53c368a54ca04c41f709c6fd4955dcb922a3bebf54a2a7f2f70e133166f52f4f537bd12f9adce3b12a1e1e875bef317b90d57644d1a2fa7dd23f0bdcbee6fafcd3327404f42b04cd9cc977f041f8a1c4d8d4ad939772deb337f540505108fba747c915dbf5e1cbf3a7d1fde24025f33cc65c5fc1d61a87d377e3777fb654fab666466e2884b8b3b9976f381dd90fc4f49a8a47ab4d44e5dbbfa61c8180c6f292877b59979e2fb9bbeee64e903dd4df8898c3ac78e49e81993b23777297a17c98d8e787ba202eaefffa2096d8c6eec2a96e3263abff32201755792a253a59f890e7582d3d0283997b2d4389981a5b179e5d875ef9184a9c68e909a5cfa8ca9b96cadbec31afb33bbf47d41966d26cb6bfc7a568f4bf6c2c059f131967c5c4269044709f9c954eab864d47330be9c1ffb502d9c8fce2ef8624133ee165185aec568da2f0f73506891c04f7e349e9a4344e36b3716918efe2d756c8ca7ad00a997b3ba5b1e928d9d92c93dee0aeaceb5516b4f762390e79b2d3996315df96d0db347da6b2994fd6bde247a704756958a81d7b7fcb7eddc3e0bd604e61ff543f8e3ea7f5193a88a3362b8f0ae0726936087ba7cf6d26436adfe861a93a8eb1f243a5e16ba0423ab3c9a8ac8fcb04b3a9cd94ffe509084dd573e7bfe49788356f1dd225f47443156bfe68da89ecfcb382aae6c887f960bdedcb110db2461eb5e95d51d174ce8bf4d2fcdab9c1506a1c563d14640488d41548028c1bf86f83dac25f6129acc31fb18c765c5fb8462f36f10f59a81ee3247d6f3d8091f6a14124744efa495cff6f4b008d2b127d702a1add49202619f8ee5deb4e53d649e752cb50fe88119f68be095521e9e12db613c0bcc3cc2eea65068bc0dcd03ab7005793dc3ab88296270d15f22adce1a7fa61bed85c7c09f3eb944c4a5490215383c36c64458b5fef84cf99e2818d76d84ea3e805f457034588b0bd57667e10df5b417b54ed5044bdab53080f5e87ca6f9b8ab4b53f19f2312d866cc297319c13ff8159be6023eb6e1d8db1018f0b56e80270980a63b85c6d9fc187fb37ae1ee70b7dc3a6152262121f97906799aa075c5273e38571e6157dfda31a867c27fe3133e81b88ef060bebceb8f2c447fcbcb2d136729d6bcda39d48c241d1a3cbc589ed80793f81e6b1c54be5a816ea5ac41b8ecbac3c02ac81a84607b9d7697624b84d18e4a67413fc025ba891899a8637efa0b9cf7210b63d7a84181a356ac0fcfa958be7f74d084cbe86fa5537571a177dc2fa1993813d825b9319ecac163e0bd31d02ccab2eea1efafb209ac5565988149d6d6790a27c4ec1589daf8cb9e84641432eae8171300cb53eb18a86840a5d017e082cd06ba247b6f6a9ccbad2f7fad03f325b8fe9acb0b4da7d6d2ab4dee8909968da01dbdba3b6dceb5191beef49b8d756b016390bad75a81874ce26c6a8ff5964b3dc11bcf1cf4862f260500b5331db1476373b5341c5c02866d43f18a7b935f791d92deeeb04e40c8e66abf7e1444b1695907f91b227d05e2e404a7e45b276910324165a7eab3609c36337e81d1a2a34a4f99de41140244adaa6a223378522597f21cad82884e660e09415b68ea7737b8c2ee33a52f08a35a49081ca793319cc8ce750f5172fd2f45982c7e900c8bee76e689dda9a71bade2a69c738bb8c0d27e015cb450407d9490be9193c936f6768ce6628c40ba77f51e2c1669b15fc5513db625d901a61cbca825756bec16d5911d45788fe387eb41cabf797c49fe541ee0ab80be390ac5916c7b1bad6326c63f5cd2f8d2bcb287676cde32f25c7985ccf5cb47d3c512626557feb4c37960430d4c9912c667a9d22406250f82a6aeecc8fc9b5413d947f4c3cfafe15cb2ca74a8fa6020d094cf892a50e1d7202dfe3c4d310f948cbff51f9585955ee596551204a372846887c8e32c6615d0d3f447f9e1dca26dfa3621ef34ec156dea0546b6d3de25e27c6c3e74dd9253890c2796fdde618f7ec86c7abb2dc17485c574456b392fc1ede02ca631"}}, {0x50, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0x4a, 0x1, "b1371051f82e07964b583efebe0f8a4e1de5429c7575fa07ac2a66f411c342926dadf2c563e9fcf99975d926385ab883d0b287a9a4ea15c10f1d9717e3c846772b565951b49d"}}]}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x3}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x2}]}, 0x10a8}, 0x1, 0x0, 0x0, 0x44000}, 0x20000000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r3, &(0x7f0000000340)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x24, 0x0, 0x95, 0x8002, 0x3, 0x3e, 0x101, 0x294, 0x40, 0x24d, 0xfffffff6, 0x0, 0x38, 0x1, 0xfffd, 0xffff, 0x8}, [{0x3, 0x4, 0x7, 0xa, 0x101, 0x6, 0x7, 0xffffffffffffff7f}]}, 0x78) close(r3) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001a70000140007000000000000"], 0x74}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-syz_emit_ethernet-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_TEST_RUN-ioctl$KVM_SET_USER_MEMORY_REGION-ioctl$KVM_CREATE_VCPU-socket$nl_generic-syz_genetlink_get_family_id$ipvs-sendmsg$IPVS_CMD_NEW_DAEMON-ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD-socket$inet-getsockopt$inet_mreqsrc-syz_kvm_setup_cpu$x86-socket$nl_generic-ioctl$sock_SIOCETHTOOL-ioctl$KVM_RUN detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="6400000002060103000000000000000000000000050001000700000016000300686173683a6e65742c706f72742c6e65740000000900020073797a30000000000500040000000000050005000a000000140007800800124000000000050015"], 0x64}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000180)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "5c6f408621f539d8"}}}}}, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x50) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000007440), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000007580)={0x0, 0x0, &(0x7f0000007540)={&(0x7f0000000000)={0x44, r6, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vlan0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}]}]}, 0x44}}, 0x48088) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x8, 'macsec0\x00', {'wlan1\x00'}}) r7 = socket$inet(0x2, 0x3, 0x30) getsockopt$inet_mreqsrc(r7, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000080)=0x2c) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fd7000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r8, 0x89fc, &(0x7f0000000040)={'bond0\x00', 0x0}) ioctl$KVM_RUN(r4, 0xae80, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_route-socket$inet6_udp-setsockopt$IP6T_SO_SET_REPLACE-sendmsg$nl_route-sendmsg$nl_route_sched-syz_open_dev$vbi-socket$inet6_tcp-close-socket$inet6_mptcp-bind$inet6-listen-socket$inet_mptcp-connect$inet-openat$hpet-socket$nl_generic-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-socket$nl_generic-socket$inet_udp-setsockopt$IPT_SO_SET_REPLACE-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_ADD_ADDR-socket$netlink-sendmmsg detailed listing: executing program 0: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x2, 0x4, 0x398, 0xffffffff, 0x0, 0xd0, 0x1f8, 0xfeffffff, 0xffffffff, 0x2c8, 0x2c8, 0x2c8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev, @mcast1, [], [0x0, 0xffffff00, 0xffffffff], 'bridge_slave_0\x00', 'bond_slave_0\x00', {}, {}, 0x0, 0x0, 0x2, 0x24}, 0x2f2, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@frag={{0x30}, {[0x3, 0x68e], 0x3}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x376a, 0xdf8, 0x6}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x4}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[], 0x44}}, 0x20040001) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x200, 0x70bd2e, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x1, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) syz_open_dev$vbi(&(0x7f0000000040), 0x1, 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r2, 0xfffffffc) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x402, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="30000000bb93289b2170eb9b6b52d7280a868c309da88e9c11839d8cb0b056018c9617f75bcb470433939a5af040d225a7792827168b4a2e8dce0000000000007749000008000000004d000000f5bfddc145ca9c6c5e182101bf9fa775dfce538de97b53d5fc3c06ed9f12e1ff7c0100000000000000419b6da9c7cbbd4963fb66bc35f44e02ebd116f1e629d0c66b13c0534097eec4d0380aa4618b8791168c4246492f2dffe68cdca845f6e4a61f626de00e259f131b27aa9da6e3d05f69cb69244014777f6b3af461078b515bc1314e19397a7f406bee32c807c5cdbee7109950ab75d3384e2df3e1c61a0f38c81ad5c25955a0", @ANYRES16=r5, @ANYBLOB="01000000000000000000010000001c000180060001000200000008000300ac1414aa0800060006000000"], 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000440)=@nat={'nat\x00', 0x62, 0x5, 0x3e0, 0x0, 0x178, 0xffffffff, 0x0, 0x2a0, 0x348, 0x348, 0xffffffff, 0x348, 0x348, 0x5, 0x0, {[{{@uncond, 0x0, 0x98, 0xd0, 0x0, {0x22e}, [@common=@unspec=@state={{0x28}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x25, {0x3, @local, @broadcast}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @remote, @empty, @gre_key, @gre_key}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 'batadv0\x00', 'bond0\x00'}, 0x0, 0xf0, 0x128, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00'}}, @common=@addrtype={{0x30}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @multicast1, @multicast2, @gre_key, @gre_key}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @local, @broadcast, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x440) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mlock2-mremap-socket$nl_generic-migrate_pages-openat$ptmx-ioctl$TIOCSETD-readv-socket$nl_generic-bpf$MAP_CREATE_CONST_STR-bpf$BPF_GET_MAP_INFO-bpf$BPF_MAP_GET_FD_BY_ID-sendmsg$nl_route_sched-socket$nl_route-socket$nl_route-sendmsg$nl_route-mremap-socket$nl_route-keyctl$instantiate-add_key-socket$nl_netfilter-sendmsg$IPSET_CMD_CREATE-socketpair$unix-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$sock_SIOCGIFINDEX-sendmsg$IPSET_CMD_DESTROY-sendmsg$nl_route detailed listing: executing program 0: mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) socket$nl_generic(0x10, 0x3, 0x10) migrate_pages(0x0, 0x5, &(0x7f0000000000)=0x9, &(0x7f0000000080)=0x272) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x60000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x19) readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000200)=""/66, 0x42}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000012c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000002c0)={r1, 0x58, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001200)={r2}, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1d, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x101}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x6}}}}]}]}, 0x70}}, 0x20040000) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r5], 0x90}}, 0x0) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000ff5000/0x3000)=nil) r6 = socket$nl_route(0x10, 0x3, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='load ecryptfs user:trusted: '], 0x32, 0xfffffffffffffffc) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="600000000206050000000000000000000000000005000100070000000900020073797a3000000000140007800800124040000000080013400000000014000300686173683a69702c706f72742c6970000500050002000000050004"], 0x60}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) sendmsg$IPSET_CMD_DESTROY(r7, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xb09565ad77cd5983}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0x4c, 0x3, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x44000) sendmsg$nl_route(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="540000001000010027bd7000fbd9dfa500000000", @ANYRESOCT=r3, @ANYBLOB="104e0600d5be225934001280110001006272696467655f736c617665000000001c0005800500080025"], 0x54}, 0x1, 0x0, 0x0, 0x404c000}, 0x2) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fanotify_init-io_setup-fsopen-openat$tun-ioctl$TUNSETIFF-socket-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-syz_open_dev$sndpcmp-ioctl$SNDRV_PCM_IOCTL_TTSTAMP-sendmsg$nl_route-fsconfig$FSCONFIG_SET_STRING-fsconfig$FSCONFIG_SET_STRING-io_submit detailed listing: executing program 0: r0 = fanotify_init(0x10, 0x1) (async) io_setup(0xedf, &(0x7f0000001740)=0x0) (async) r2 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) (async) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xb, 0x6}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x655c, 0x2, 0x1ffffffe, 0x9, 0x800}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) r7 = syz_open_dev$sndpcmp(&(0x7f0000000140), 0xd, 0x0) ioctl$SNDRV_PCM_IOCTL_TTSTAMP(r7, 0x40044103, &(0x7f0000000180)=0x1) (async) sendmsg$nl_route(r4, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000200)={&(0x7f0000000340)=@ipv6_getnexthop={0x5c, 0x6a, 0x8, 0x70bd2a, 0x25dfdbfc, {}, [@NHA_ID={0x8}, @NHA_OIF={0x8, 0x5, r6}, @NHA_GROUPS={0x4}, @NHA_GROUPS={0x4}, @NHA_MASTER={0x8}, @NHA_MASTER={0x8, 0xa, 0x2}, @NHA_MASTER={0x8}, @NHA_GROUPS={0x4}, @NHA_GROUPS={0x4}, @NHA_MASTER={0x8, 0xa, 0x1}, @NHA_FDB={0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x44800) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) (async) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f00000000c0)='source', &(0x7f00000001c0)='source', 0x0) io_submit(r1, 0x1, &(0x7f0000001a40)=[&(0x7f00000017c0)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$nl_route-bpf$PROG_LOAD-sendmsg$nl_route-sendmsg$nl_route-socket$nl_route-socket$nl_route-bpf$PROG_LOAD-sendmsg$nl_route-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2749baca85309be96d5a45bbb29ea06f9cbc7eea15bc1ee369d2707231280f0415df341ab76de90db5ff7ffffffd075b373f51be98db7efbbe8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c1f870adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eacb4389adbb47efb7b3f19046c7f1bd1bf56e58555d96137f95b3aacd74ed1c8a8676468cf2405e48723c6b1ff3698422f88ffed8617dd64330f4c38ba86e3b50da03f4b1e4808aa5c9e9546d7190747c6abc5beab28cec4ff7faa3fab48cdb3d64cfd5d698416752a16f32a54ccef577832e4cf684fce2cb0bab7f6a5821b26483322000000000000596c6e1ac996b8a0924948750b6e52c09d53950e5c8143db8669f8a5bf6511df822532e3c78d019149651255048aab0399e5d6e317b6f3fbc2600ffc3c66c7244b7bcf6b78b5e8c0ee04ce344ceb084b4f2ef09b59a36a92b3874edc559e5bf58a567d385ba92df9121dfa257e60655dcbff581c75107b01b5baaf29ebaf24861c538fefcaecb52a6b69fc450e10645df60a9d50131466113c6aac5abbcf9e9f2f0384da3f9892af413bd87f51f7f0cf61096fd79327fa66effe89a72d7a75d40f0c1ad299f55eafcd52a39649ab6021e30f901933f11092"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x18) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="34000000100001f8ffffff000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r2, @ANYBLOB="08001b"], 0x34}}, 0x4004010) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c00000010000108000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="0040000080a0040014002b8008000100", @ANYRES32=r2, @ANYBLOB="080003000000000008001b0000000000854b31d250511c56b5f8a794c669be51cff301a550a9c27194d131262b43f65dc96ab63f96aec5e8908ee15d7fb79b5b09b9a5a2c9301db1d429ee20a42da69958c6916ca1649eeda7afc72b75eb0b38d34aaed1908f490c5b24b616ec03a5837bd86dfd7c89e31f8e52f3acf080b09a7c513e"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2749baca85309be96d5a45bbb29ea06f9cbc7eea15bc1ee369d2707231280f0415df341ab76de90db5ff7ffffffd075b373f51be98db7efbbe8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c1f870adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eacb4389adbb47efb7b3f19046c7f1bd1bf56e58555d96137f95b3aacd74ed1c8a8676468cf2405e48723c6b1ff3698422f88ffed8617dd64330f4c38ba86e3b50da03f4b1e4808aa5c9e9546d7190747c6abc5beab28cec4ff7faa3fab48cdb3d64cfd5d698416752a16f32a54ccef577832e4cf684fce2cb0bab7f6a5821b26483322000000000000596c6e1ac996b8a0924948750b6e52c09d53950e5c8143db8669f8a5bf6511df822532e3c78d019149651255048aab0399e5d6e317b6f3fbc2600ffc3c66c7244b7bcf6b78b5e8c0ee04ce344ceb084b4f2ef09b59a36a92b3874edc559e5bf58a567d385ba92df9121dfa257e60655dcbff581c75107b01b5baaf29ebaf24861c538fefcaecb52a6b69fc450e10645df60a9d50131466113c6aac5abbcf9e9f2f0384da3f9892af413bd87f51f7f0cf61096fd79327fa66effe89a72d7a75d40f0c1ad299f55eafcd52a39649ab6021e30f901933f11092"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x18) (async) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="34000000100001f8ffffff000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r2, @ANYBLOB="08001b"], 0x34}}, 0x4004010) (async) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c00000010000108000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="0040000080a0040014002b8008000100", @ANYRES32=r2, @ANYBLOB="080003000000000008001b0000000000854b31d250511c56b5f8a794c669be51cff301a550a9c27194d131262b43f65dc96ab63f96aec5e8908ee15d7fb79b5b09b9a5a2c9301db1d429ee20a42da69958c6916ca1649eeda7afc72b75eb0b38d34aaed1908f490c5b24b616ec03a5837bd86dfd7c89e31f8e52f3acf080b09a7c513e"], 0x3c}}, 0x0) (async) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$netlink-socket-sendmsg$nl_route_sched-getsockname$packet-sendmsg$nl_route-socket$nl_route-socket-getsockname$packet-sendmsg$nl_route-socket$netlink-socket$packet-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r5], 0x54}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000001000250800170000000000000a000000", @ANYRES32=r8, @ANYBLOB="01"], 0x20}, 0x1, 0x0, 0x34000}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$netlink-socket-sendmsg$nl_route_sched-getsockname$packet-sendmsg$nl_route-socket$nl_route-socket-getsockname$packet-sendmsg$nl_route detailed listing: executing program 0: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0003006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r5], 0x54}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$cgroup_ro-unshare-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) unshare(0x6a040000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000030900010073797a3100000000e8010000030a01020000000000000000010000000900030073797a3200000000280004800800024000000000080001400000000514000300626174616476300000000000000000000900010073797a31000000000900010073797a3100000000340008800c00024000000000000080010c00024000000000000000040c00014000000000000000000c00014000000000000000014c000480080002404c82f47c080001400000000008000140000000010800014000000003080002404f32945f080001400000000308000140000000020800024019885f270800014000000003fd000c00a03ac330bf11a2145946e6d945deece8485ee69dbc29a8dd5dbce127f829a3adf5c4171b4bedbbc9b913a67b9ee679020f0200000064419faae0136b893d91d95b1174f115798a1abfdc06983fb83f2116a85a00dd35cdf9d8f81683e5e2ebcca132a712e0be44c12c02ac92fbbb86ed717ce0cbd6a0134f899e23ca6d2f063d26be86555cc0e9c7a25d77e6c0f4217794be96b5d797e3116d874c3adfb096e0567ec28bd1e4d8d6713109695f1f3a877d89d20e19304501aeb851d14c4f9b2d769d554fe5308810d19bb040c1977bce50b894f2c45a1f0e80c8256b6dcb072f9d91d94a67bba9f62eb2f192fa4b3786d9a774b99aa332dfbb000000080007006e6174"], 0x25c}}, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 83 programs with base timeout 30s testing program (duration=50s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 10, 14, 10, 16, 27, 24, 19, 2, 8, 22, 8, 4, 7, 30, 17, 7, 10, 7, 2, 9, 14, 14, 10, 7, 26, 10, 27, 2, 9, 2, 10, 24, 19, 4, 15, 4, 26, 15, 4, 19, 15, 8, 30, 18, 13, 18, 4, 17, 12, 2, 3, 30, 30, 5, 11, 30, 12, 15, 10, 4, 28, 17, 2, 40, 15, 28, 2, 40, 25, 30, 2, 9, 23, 5, 14, 2, 6, 2, 16, 14, 14, 14] detailed listing: executing program 32: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) unshare(0x6a040000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000030900010073797a3100000000e8010000030a01020000000000000000010000000900030073797a3200000000280004800800024000000000080001400000000514000300626174616476300000000000000000000900010073797a31000000000900010073797a3100000000340008800c00024000000000000080010c00024000000000000000040c00014000000000000000000c00014000000000000000014c000480080002404c82f47c080001400000000008000140000000010800014000000003080002404f32945f080001400000000308000140000000020800024019885f270800014000000003fd000c00a03ac330bf11a2145946e6d945deece8485ee69dbc29a8dd5dbce127f829a3adf5c4171b4bedbbc9b913a67b9ee679020f0200000064419faae0136b893d91d95b1174f115798a1abfdc06983fb83f2116a85a00dd35cdf9d8f81683e5e2ebcca132a712e0be44c12c02ac92fbbb86ed717ce0cbd6a0134f899e23ca6d2f063d26be86555cc0e9c7a25d77e6c0f4217794be96b5d797e3116d874c3adfb096e0567ec28bd1e4d8d6713109695f1f3a877d89d20e19304501aeb851d14c4f9b2d769d554fe5308810d19bb040c1977bce50b894f2c45a1f0e80c8256b6dcb072f9d91d94a67bba9f62eb2f192fa4b3786d9a774b99aa332dfbb000000080007006e6174"], 0x25c}}, 0x0) executing program 33: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0003006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r5], 0x54}}, 0x0) executing program 34: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc00000000000000000000000000000008000a00", @ANYRES32=r5], 0x54}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) getsockname$packet(r7, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="200000001000250800170000000000000a000000", @ANYRES32=r8, @ANYBLOB="01"], 0x20}, 0x1, 0x0, 0x34000}, 0x0) executing program 35: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2749baca85309be96d5a45bbb29ea06f9cbc7eea15bc1ee369d2707231280f0415df341ab76de90db5ff7ffffffd075b373f51be98db7efbbe8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c1f870adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eacb4389adbb47efb7b3f19046c7f1bd1bf56e58555d96137f95b3aacd74ed1c8a8676468cf2405e48723c6b1ff3698422f88ffed8617dd64330f4c38ba86e3b50da03f4b1e4808aa5c9e9546d7190747c6abc5beab28cec4ff7faa3fab48cdb3d64cfd5d698416752a16f32a54ccef577832e4cf684fce2cb0bab7f6a5821b26483322000000000000596c6e1ac996b8a0924948750b6e52c09d53950e5c8143db8669f8a5bf6511df822532e3c78d019149651255048aab0399e5d6e317b6f3fbc2600ffc3c66c7244b7bcf6b78b5e8c0ee04ce344ceb084b4f2ef09b59a36a92b3874edc559e5bf58a567d385ba92df9121dfa257e60655dcbff581c75107b01b5baaf29ebaf24861c538fefcaecb52a6b69fc450e10645df60a9d50131466113c6aac5abbcf9e9f2f0384da3f9892af413bd87f51f7f0cf61096fd79327fa66effe89a72d7a75d40f0c1ad299f55eafcd52a39649ab6021e30f901933f11092"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x18) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="34000000100001f8ffffff000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r2, @ANYBLOB="08001b"], 0x34}}, 0x4004010) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c00000010000108000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="0040000080a0040014002b8008000100", @ANYRES32=r2, @ANYBLOB="080003000000000008001b0000000000854b31d250511c56b5f8a794c669be51cff301a550a9c27194d131262b43f65dc96ab63f96aec5e8908ee15d7fb79b5b09b9a5a2c9301db1d429ee20a42da69958c6916ca1649eeda7afc72b75eb0b38d34aaed1908f490c5b24b616ec03a5837bd86dfd7c89e31f8e52f3acf080b09a7c513e"], 0x3c}}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) socket$nl_route(0x10, 0x3, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000006c0)=ANY=[@ANYBLOB="18020000000000000000000000000030850000002c00000095000000000000002b4003fe37a077ae55f52c0d80a2749baca85309be96d5a45bbb29ea06f9cbc7eea15bc1ee369d2707231280f0415df341ab76de90db5ff7ffffffd075b373f51be98db7efbbe8e04acb807fbbabc68abdcce9f672b6bb61c302dfd5c1f870adac29fd64d33a3502fbeb1ed99dd0e792f24c420bfcc2635421d339ad521d6953b1137850d9e9ebf65ee988ea2dbee528678eacb4389adbb47efb7b3f19046c7f1bd1bf56e58555d96137f95b3aacd74ed1c8a8676468cf2405e48723c6b1ff3698422f88ffed8617dd64330f4c38ba86e3b50da03f4b1e4808aa5c9e9546d7190747c6abc5beab28cec4ff7faa3fab48cdb3d64cfd5d698416752a16f32a54ccef577832e4cf684fce2cb0bab7f6a5821b26483322000000000000596c6e1ac996b8a0924948750b6e52c09d53950e5c8143db8669f8a5bf6511df822532e3c78d019149651255048aab0399e5d6e317b6f3fbc2600ffc3c66c7244b7bcf6b78b5e8c0ee04ce344ceb084b4f2ef09b59a36a92b3874edc559e5bf58a567d385ba92df9121dfa257e60655dcbff581c75107b01b5baaf29ebaf24861c538fefcaecb52a6b69fc450e10645df60a9d50131466113c6aac5abbcf9e9f2f0384da3f9892af413bd87f51f7f0cf61096fd79327fa66effe89a72d7a75d40f0c1ad299f55eafcd52a39649ab6021e30f901933f11092"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x1000, &(0x7f0000001400)=""/4106, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x18) (async) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=ANY=[@ANYBLOB="34000000100001f8ffffff000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r2, @ANYBLOB="08001b"], 0x34}}, 0x4004010) (async) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="3c00000010000108000000000400000000000000", @ANYRES32=0x0, @ANYBLOB="0040000080a0040014002b8008000100", @ANYRES32=r2, @ANYBLOB="080003000000000008001b0000000000854b31d250511c56b5f8a794c669be51cff301a550a9c27194d131262b43f65dc96ab63f96aec5e8908ee15d7fb79b5b09b9a5a2c9301db1d429ee20a42da69958c6916ca1649eeda7afc72b75eb0b38d34aaed1908f490c5b24b616ec03a5837bd86dfd7c89e31f8e52f3acf080b09a7c513e"], 0x3c}}, 0x0) (async) executing program 36: r0 = fanotify_init(0x10, 0x1) (async) io_setup(0xedf, &(0x7f0000001740)=0x0) (async) r2 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) (async) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0x0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r6, {0xb, 0x6}, {}, {0x7}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x655c, 0x2, 0x1ffffffe, 0x9, 0x800}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x10}, 0x0) r7 = syz_open_dev$sndpcmp(&(0x7f0000000140), 0xd, 0x0) ioctl$SNDRV_PCM_IOCTL_TTSTAMP(r7, 0x40044103, &(0x7f0000000180)=0x1) (async) sendmsg$nl_route(r4, &(0x7f00000002c0)={&(0x7f0000000080), 0xc, &(0x7f0000000200)={&(0x7f0000000340)=@ipv6_getnexthop={0x5c, 0x6a, 0x8, 0x70bd2a, 0x25dfdbfc, {}, [@NHA_ID={0x8}, @NHA_OIF={0x8, 0x5, r6}, @NHA_GROUPS={0x4}, @NHA_GROUPS={0x4}, @NHA_MASTER={0x8}, @NHA_MASTER={0x8, 0xa, 0x2}, @NHA_MASTER={0x8}, @NHA_GROUPS={0x4}, @NHA_GROUPS={0x4}, @NHA_MASTER={0x8, 0xa, 0x1}, @NHA_FDB={0x4}]}, 0x5c}, 0x1, 0x0, 0x0, 0x1}, 0x44800) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000000)='source', &(0x7f0000000040)='c:::\x00', 0x0) (async) fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f00000000c0)='source', &(0x7f00000001c0)='source', 0x0) io_submit(r1, 0x1, &(0x7f0000001a40)=[&(0x7f00000017c0)={0x0, 0x0, 0x0, 0x5, 0x0, r0, 0x0}]) executing program 37: mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) socket$nl_generic(0x10, 0x3, 0x10) migrate_pages(0x0, 0x5, &(0x7f0000000000)=0x9, &(0x7f0000000080)=0x272) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x60000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0x19) readv(r0, &(0x7f00000004c0)=[{&(0x7f0000000200)=""/66, 0x42}], 0x1) socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000012c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f00000002c0)={r1, 0x58, &(0x7f0000000240)={0x0, 0x0}}, 0x10) r3 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001200)={r2}, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtaction={0x70, 0x30, 0x0, 0x0, 0x0, {0x9}, [{0x5c, 0x1, [@m_sample={0x58, 0x1d, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_SAMPLE_RATE={0x8, 0x3, 0x101}, @TCA_SAMPLE_RATE={0x8}, @TCA_SAMPLE_PARMS={0x18, 0x2, {0x0, 0x0, 0x0, 0x0, 0x80000}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x6}}}}]}]}, 0x70}}, 0x20040000) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="9000000010000305000000000000000000000700", @ANYRES32=0x0, @ANYBLOB="996e06004d4c0700540012800800010068737200480002800500030008000000050003000500000005000300fd00000008000200", @ANYRES32=r4, @ANYBLOB="08000100", @ANYRES32=r5], 0x90}}, 0x0) mremap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x3000, 0x3, &(0x7f0000ff5000/0x3000)=nil) r6 = socket$nl_route(0x10, 0x3, 0x0) keyctl$instantiate(0xc, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB='load ecryptfs user:trusted: '], 0x32, 0xfffffffffffffffc) add_key(&(0x7f0000000140)='encrypted\x00', &(0x7f0000000180), &(0x7f0000000100), 0xca, 0xfffffffffffffffe) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="600000000206050000000000000000000000000005000100070000000900020073797a3000000000140007800800124040000000080013400000000014000300686173683a69702c706f72742c6970000500050002000000050004"], 0x60}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r9, 0xae41, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'bridge_slave_1\x00'}) sendmsg$IPSET_CMD_DESTROY(r7, &(0x7f00000003c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0xb09565ad77cd5983}, 0xc, &(0x7f0000000380)={&(0x7f0000000280)={0x4c, 0x3, 0x6, 0x201, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40}, 0x44000) sendmsg$nl_route(r6, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=ANY=[@ANYBLOB="540000001000010027bd7000fbd9dfa500000000", @ANYRESOCT=r3, @ANYBLOB="104e0600d5be225934001280110001006272696467655f736c617665000000001c0005800500080025"], 0x54}, 0x1, 0x0, 0x0, 0x404c000}, 0x2) executing program 38: sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x2, 0x4, 0x398, 0xffffffff, 0x0, 0xd0, 0x1f8, 0xfeffffff, 0xffffffff, 0x2c8, 0x2c8, 0x2c8, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@dev, @mcast1, [], [0x0, 0xffffff00, 0xffffffff], 'bridge_slave_0\x00', 'bond_slave_0\x00', {}, {}, 0x0, 0x0, 0x2, 0x24}, 0x2f2, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@uncond, 0x0, 0x100, 0x128, 0x0, {}, [@common=@frag={{0x30}, {[0x3, 0x68e], 0x3}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x376a, 0xdf8, 0x6}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x4}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[], 0x44}}, 0x20040001) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x200, 0x70bd2e, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffe0}, {0xffff, 0xffff}, {0x1, 0x9}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x4000000) syz_open_dev$vbi(&(0x7f0000000040), 0x1, 0x2) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r1) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r2, 0xfffffffc) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r3, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) openat$hpet(0xffffffffffffff9c, &(0x7f00000000c0), 0x402, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="30000000bb93289b2170eb9b6b52d7280a868c309da88e9c11839d8cb0b056018c9617f75bcb470433939a5af040d225a7792827168b4a2e8dce0000000000007749000008000000004d000000f5bfddc145ca9c6c5e182101bf9fa775dfce538de97b53d5fc3c06ed9f12e1ff7c0100000000000000419b6da9c7cbbd4963fb66bc35f44e02ebd116f1e629d0c66b13c0534097eec4d0380aa4618b8791168c4246492f2dffe68cdca845f6e4a61f626de00e259f131b27aa9da6e3d05f69cb69244014777f6b3af461078b515bc1314e19397a7f406bee32c807c5cdbee7109950ab75d3384e2df3e1c61a0f38c81ad5c25955a0", @ANYRES16=r5, @ANYBLOB="01000000000000000000010000001c000180060001000200000008000300ac1414aa0800060006000000"], 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000440)=@nat={'nat\x00', 0x62, 0x5, 0x3e0, 0x0, 0x178, 0xffffffff, 0x0, 0x2a0, 0x348, 0x348, 0xffffffff, 0x348, 0x348, 0x5, 0x0, {[{{@uncond, 0x0, 0x98, 0xd0, 0x0, {0x22e}, [@common=@unspec=@state={{0x28}}]}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x25, {0x3, @local, @broadcast}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @REDIRECT={0x38, 'REDIRECT\x00', 0x0, {0x1, {0x0, @remote, @empty, @gre_key, @gre_key}}}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 'batadv0\x00', 'bond0\x00'}, 0x0, 0xf0, 0x128, 0x0, {}, [@common=@osf={{0x50}, {'syz0\x00'}}, @common=@addrtype={{0x30}}]}, @DNAT0={0x38, 'DNAT\x00', 0x0, {0x1, {0x0, @multicast1, @multicast2, @gre_key, @gre_key}}}}, {{@uncond, 0x0, 0x70, 0xa8}, @NETMAP={0x38, 'NETMAP\x00', 0x0, {0x1, {0x0, @local, @broadcast, @icmp_id}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x440) r8 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000200)={0x20, r8, 0x1, 0x0, 0x0, {0x7}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r9, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 39: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="6400000002060103000000000000000000000000050001000700000016000300686173683a6e65742c706f72742c6e65740000000900020073797a30000000000500040000000000050005000a000000140007800800124000000000050015"], 0x64}}, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000180)={@link_local={0x3}, @multicast, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @private=0xa010100, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x12, 0x0, 0x3f18, {0x5, 0x2, 0x0, 0x0, 0x0, 0x68, 0x0, 0x0, 0x1, 0x0, @loopback, @loopback}, "5c6f408621f539d8"}}}}}, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f00000000c0)='\x00', 0x0, 0x2}, 0x50) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000000)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000007440), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_DAEMON(r5, &(0x7f0000007580)={0x0, 0x0, &(0x7f0000007540)={&(0x7f0000000000)={0x44, r6, 0x1, 0x70bd28, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_DAEMON={0x30, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_IFN={0x14, 0x2, 'vlan0\x00'}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @empty}]}]}, 0x44}}, 0x48088) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x8, 'macsec0\x00', {'wlan1\x00'}}) r7 = socket$inet(0x2, 0x3, 0x30) getsockopt$inet_mreqsrc(r7, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000080)=0x2c) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000fd7000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCETHTOOL(r8, 0x89fc, &(0x7f0000000040)={'bond0\x00', 0x0}) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 40: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001a70000140007000000000000"], 0x74}}, 0x0) executing program 41: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f00000000c0)={&(0x7f00000003c0)={0x10a8, r1, 0x1, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0xd}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_CONDITION={0x8, 0x2, 0x1}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x1}, @NL80211_ATTR_COALESCE_RULE_PKT_PATTERN={0x105c, 0x3, 0x0, 0x1, [{0x1008, 0x0, 0x0, 0x1, @NL80211_PKTPAT_PATTERN={0x1004, 0x2, "bbf9e5be1ff44d8c120bf2eef57449b359d7ad92cd80ec23fac8eec7fc81d567f06b7366d73aa855b1ee69595fef6ef55c07a5aa1e950991bcde812e198b3e8e0bac19a9dc68a9b310e437c154de7e243dea3a09bbed1d267b7c72e5217cd242cdb54423de60279650e4a5c5dae320443c8d5be8ee4e43d7a282e48729f85fdc5666353b26aa92f1e5069ab2d74115357357f91ed8a74b50a49fdb93796cb2dc373e7d309accc5eb6a7ba007f79ad2628f2aa525d8b63511213191bf0ec427a71ecec6db4faa3de240bd67d32be9eecce9cecdbe8f77430347978d531900eba4e00fd439e679d75af171b7ff93d39cae6599b7a83c1d0251da5f637779e8b5c4f21734176d48521e5e039bfa3262289a22a5982f6ebece51c0589d400e5394b82c79aa31390ba8a0974f4f93cf37503ffa1df7660dc95ea029b455dd5ce645cc82862059b5d6545e0b038a6086821c59df08cf0224c2e8f9e9a973f34b59281d253ca93f9f8e235f10540527193304b8ec4a1a093c3134a926cd391269b652b988e2b64793f4c1713c7b7063ee1cbd9fd86bd9c2bb6f8433030439e917499036ddac24883698158cf1080217dc45ac2110b7491457a9c39f97bd2a7f15316c644592bb6459e534c722f230a21f7a6bbd2ecb9828c853344189fa0b877dd38da176c7cced4d5f5a1d96ec84a26eff9e9b67ccb3b6826e6fd9e6de845ac75354fadab6323dea57b3154e0d1a900f84eb5b1864605066b263fcda559b33b5103fb9e8ed91b837b5571d986be9c6da4288e600b8891a857644df9c7c17ab213de56fa1c2d464c32469b55e896f66ec07225b86aaeb1f578911d21c31f62517396bd853c5c6eef7714ffa04db986867950c82f4d2cf76c08cb21e27fe1c01a8ef9af52360b0f144e586e6988f269801d7acafc12d8dd5dc9c857e4fbdaa8aef2daac84bf215b52a652394173bc58dc7966dcd2018b5df7553bf910863ed2494af8779d754db28757e3f14833d8205633575a8f1a07aa9b29dbdd749077a5a9a7e56c2236306bed25b441a4724ade2c9930800f970e5a49599affebd727ffe0f20dcd5dae5fd4e834859da5586e57cf49ab6e42480db0bf41f68d546dfcc2855372c0929df3faffba494a4ba4228c61ca3dc2888b5ab21307bb99fb425be02c6c5e668f6d5f170935dd13650547bab7ebdec4a08586b1081c6764314c101e94fa1cc1472bac25867a9a770d6b82b298740d38d7debf535adc6c30f53a21ba6bcfc4d39fc9f040881682c4a6e7792ec39f92e95121bc6bebba285af9aee6d827f47a32f35e28742ab31fb9181da1e310c0c868ad11bf43977135e0c3d8b2f11e6f0b3920ac958546e99b2cfe60e8b0657986774c4f25e1759a92866e1bd50ebbbb5effd8ba8e80e9e730ff953ba6b6876571e2f2dfc25c22e568e481e810dc42b59c9e6ac1ef81b3dab25a007bf8a5c43bc42ec8d23fa54f747e7f0977f06fbad61fefb76e0e434f029e68bc87781eba2c0f45ad5c20708032fe51e9ec5c9a69aaa4553f054a3f9818a984f8b39c82d0265614e35aa8c73de0336b814d5ae43ffd3b7c6003a96566735dbc4502e51106e3afde579d20a280bcba682c571ece13ac7fabb7b0fa32dea05e35b7b3c68f6e945e34ef186ba897fc648c8c68522b3291e68d058e67f89e32458e3390a54598aa1a22ad92101dfccbc0418c278ff356a78e4d950970aecabc60e62e7d5f497a6f372a865da4019e120b7d9ce020f34f6f28e8bd475e4a2fce08fc0f6075551c36765b02b197dc5ab24f15fb6fd445a9621206a2142b1502752eaa683e40ed55b9927eaff62fd6e6ffc3c2e04f4e41e0bcb361a41684c6fd3375b6b2e19856930230af09cf18a97d1ae01309242d11b6af98217bddc81da6347492d424ba8923aa2ab3fc4d5f93993308955c20b37d84dde3b3b3332f810bb37dd8b3ffa52a3deb5b7dc47db468a75d00a21a31d56a6489a4427c4b98206cda06f60c4ee38088417ef82712731d4a8a3a49881393f2ebbd0add924e3f64de750fc991d4231a07016687129c4f7015059686ca53af3a3fa57b614e49c7a6988742ddad1eea187753e0562c446cdb7b36ed66104037cb193f42d6f4869e2c1810d6b265160ef482e2587a0a79b339f45828f2aae648ad49967979a93b35b29f7a6b57339d42f51661cacf185167c2963865e2832b2f5f4c60f2c31b457b76c0822cc233c90fb3cb7733ffa0c9f80a519fc9e3d287e05401f2021959985ff280ae0a754eafdab48738828b014e39eaf30f28f68ae500fd4ec0389585dbcf136e4b8d190154c677a9590cbc85f2d87f057a328750b45f50004ddb02ebd2c1036b45c5bd2992508f9673cf419e9cbc18535b2be0e268e94d2b2ca6adfd71521b25f41f32fd1496641941d1ee384b157d4511d09116ecc85307428dd69acbf1a5f362b1eb89af74b62def83c2fe7efc585352ef6f24bbdcfdb4e70f981726874b8bc97c9519e6df965f776431ef502f36288c9d631ab7314186797f5e087272516c39d66c93503bd15763b9170bc959228e6fbbf78eb390a99c94bf5fd898f0328f072e846fe264a9ce839b8910cf570988dbffc9b264cc5f22e45ff146ff1427c85a9bc94457dd0c9a884d14cae174aaa4cfc405e522e58416a93f24af2c533c6021b99134cbc266b6d13ee88ba5a2b613321e6d685fa6b7346cbab0c31ab9d5a28b20e568f91af26230ece4d1f47c3e2e5b58cee156a4173f2e954b2f66aa625cd7fdf0159cf21cf755e092fb5d04eb4e3e897b63a0822b420cf5852157dc1130c2fa9480bc07064e52b052444f24a8f2f404dc2d6f19e93fc221f00e869f59225a58fbbe083c554f23ef26ba8a33c1c5c602f4a8bdd9bb536a4506801ec50dab38463f473dd14842fcf081ea47e2875702b0a0b0329a7b86c2c50750d36ff1b9c13d590668dc180d7cfaeb9435646b697c7d3ed497ad8dd9115a800fbeeb6f2a6f8e64dfc1595f317b6e5a6afa39088ff15d46bf8d05269303f1f64000a404151026f7933817fbf5d168477606fef974d6044cbc642b1ec7a9a45a3df72c7338300442367813622e686c6b7acb150b656c6ef36d594d2cf4744a467d21f6fcec38c0976ebc0b2b4fb1b9a6896951ad6185de88d5269a30ed3feb666eba707336cb579ac03a283b745eb97b87f9c6d18b634a4b58d01c17541965ac2505529feeb8a13e6e7deea05cff13c08ccaaef2b44e4b3b64a7555781e5d1eca80c9569c5e50900094f21e30d25488d41959c1a2f8bc95d1c0f90d88ad0c38b4debedd5ea08ee4a4024e8b85b0a85b3764d2bc344a9306204d356910f0d1502022b80e034d6118715a43e0cf54d4349d03ef513fbc7c2992c0102efc8a0c966dcdd4b9532565de096fb6e5c8a5c2b0dbf99232273c117a5bb33d1b480b53130d066398e00935a642f210de9925322b5198500a54f37f9b6a6f2c736567e69a35a9ef2ed65f135b35b3a65e7a541891537e1ccabccb03eb5ca543021c47ed658c2eca5b1cf2b270354a78d41121c18670c117083b54538bffa76e15c983f0f8c8631df796cbc48b33463d28e4840fe37a0914380eb4777829502851ddef24a4327372d0bcaa24e50d856c44cad7288cd49bcf7e3985f506cb09b7a73eff2ba69d51db6ccdd1a204a192305df2b3b3317da6294e0c9fed50ba96a0e188a8cfa944a15964e1dad94fe6a4138a5b4ee33df9c45ed56b637daca44ef6f81674a53c368a54ca04c41f709c6fd4955dcb922a3bebf54a2a7f2f70e133166f52f4f537bd12f9adce3b12a1e1e875bef317b90d57644d1a2fa7dd23f0bdcbee6fafcd3327404f42b04cd9cc977f041f8a1c4d8d4ad939772deb337f540505108fba747c915dbf5e1cbf3a7d1fde24025f33cc65c5fc1d61a87d377e3777fb654fab666466e2884b8b3b9976f381dd90fc4f49a8a47ab4d44e5dbbfa61c8180c6f292877b59979e2fb9bbeee64e903dd4df8898c3ac78e49e81993b23777297a17c98d8e787ba202eaefffa2096d8c6eec2a96e3263abff32201755792a253a59f890e7582d3d0283997b2d4389981a5b179e5d875ef9184a9c68e909a5cfa8ca9b96cadbec31afb33bbf47d41966d26cb6bfc7a568f4bf6c2c059f131967c5c4269044709f9c954eab864d47330be9c1ffb502d9c8fce2ef8624133ee165185aec568da2f0f73506891c04f7e349e9a4344e36b3716918efe2d756c8ca7ad00a997b3ba5b1e928d9d92c93dee0aeaceb5516b4f762390e79b2d3996315df96d0db347da6b2994fd6bde247a704756958a81d7b7fcb7eddc3e0bd604e61ff543f8e3ea7f5193a88a3362b8f0ae0726936087ba7cf6d26436adfe861a93a8eb1f243a5e16ba0423ab3c9a8ac8fcb04b3a9cd94ffe509084dd573e7bfe49788356f1dd225f47443156bfe68da89ecfcb382aae6c887f960bdedcb110db2461eb5e95d51d174ce8bf4d2fcdab9c1506a1c563d14640488d41548028c1bf86f83dac25f6129acc31fb18c765c5fb8462f36f10f59a81ee3247d6f3d8091f6a14124744efa495cff6f4b008d2b127d702a1add49202619f8ee5deb4e53d649e752cb50fe88119f68be095521e9e12db613c0bcc3cc2eea65068bc0dcd03ab7005793dc3ab88296270d15f22adce1a7fa61bed85c7c09f3eb944c4a5490215383c36c64458b5fef84cf99e2818d76d84ea3e805f457034588b0bd57667e10df5b417b54ed5044bdab53080f5e87ca6f9b8ab4b53f19f2312d866cc297319c13ff8159be6023eb6e1d8db1018f0b56e80270980a63b85c6d9fc187fb37ae1ee70b7dc3a6152262121f97906799aa075c5273e38571e6157dfda31a867c27fe3133e81b88ef060bebceb8f2c447fcbcb2d136729d6bcda39d48c241d1a3cbc589ed80793f81e6b1c54be5a816ea5ac41b8ecbac3c02ac81a84607b9d7697624b84d18e4a67413fc025ba891899a8637efa0b9cf7210b63d7a84181a356ac0fcfa958be7f74d084cbe86fa5537571a177dc2fa1993813d825b9319ecac163e0bd31d02ccab2eea1efafb209ac5565988149d6d6790a27c4ec1589daf8cb9e84641432eae8171300cb53eb18a86840a5d017e082cd06ba247b6f6a9ccbad2f7fad03f325b8fe9acb0b4da7d6d2ab4dee8909968da01dbdba3b6dceb5191beef49b8d756b016390bad75a81874ce26c6a8ff5964b3dc11bcf1cf4862f260500b5331db1476373b5341c5c02866d43f18a7b935f791d92deeeb04e40c8e66abf7e1444b1695907f91b227d05e2e404a7e45b276910324165a7eab3609c36337e81d1a2a34a4f99de41140244adaa6a223378522597f21cad82884e660e09415b68ea7737b8c2ee33a52f08a35a49081ca793319cc8ce750f5172fd2f45982c7e900c8bee76e689dda9a71bade2a69c738bb8c0d27e015cb450407d9490be9193c936f6768ce6628c40ba77f51e2c1669b15fc5513db625d901a61cbca825756bec16d5911d45788fe387eb41cabf797c49fe541ee0ab80be390ac5916c7b1bad6326c63f5cd2f8d2bcb287676cde32f25c7985ccf5cb47d3c512626557feb4c37960430d4c9912c667a9d22406250f82a6aeecc8fc9b5413d947f4c3cfafe15cb2ca74a8fa6020d094cf892a50e1d7202dfe3c4d310f948cbff51f9585955ee596551204a372846887c8e32c6615d0d3f447f9e1dca26dfa3621ef34ec156dea0546b6d3de25e27c6c3e74dd9253890c2796fdde618f7ec86c7abb2dc17485c574456b392fc1ede02ca631"}}, {0x50, 0x0, 0x0, 0x1, @NL80211_PKTPAT_MASK={0x4a, 0x1, "b1371051f82e07964b583efebe0f8a4e1de5429c7575fa07ac2a66f411c342926dadf2c563e9fcf99975d926385ab883d0b287a9a4ea15c10f1d9717e3c846772b565951b49d"}}]}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x3}, @NL80211_ATTR_COALESCE_RULE_DELAY={0x8, 0x1, 0x2}]}, 0x10a8}, 0x1, 0x0, 0x0, 0x44000}, 0x20000000) r3 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) write$binfmt_elf64(r3, &(0x7f0000000340)={{0x7f, 0x45, 0x4c, 0x46, 0x3, 0x24, 0x0, 0x95, 0x8002, 0x3, 0x3e, 0x101, 0x294, 0x40, 0x24d, 0xfffffff6, 0x0, 0x38, 0x1, 0xfffd, 0xffff, 0x8}, [{0x3, 0x4, 0x7, 0xa, 0x101, 0x6, 0x7, 0xffffffffffffff7f}]}, 0x78) close(r3) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) executing program 42: r0 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r0, &(0x7f00000000c0)={0x1d, r1}, 0x10) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) sendmsg$can_j1939(r2, &(0x7f0000000240)={&(0x7f0000000180)={0x1d, r3, 0x3, {0x2, 0x1, 0x4}, 0x2}, 0x18, &(0x7f00000001c0)={&(0x7f0000000480)="05f979c4f8fc48825a85022427d79b93f9990cb87d72d6a57525cc551a5e906b8117563a22985ac982da3747a7a8e42b6d9c52d76d8aff240562237d85c34480de1fc6dc1895681a75152d3a077f576e8dd1ed45627507874f03c708e898add617c59d9eb0d4db40d281ae556b2c5f6fa02fa52f0c267af0f4219df1548c1a65ab5ea21a5a58cd5ee2c95c43f54707b6b7e061ba9a99ad3c50e081023e4372484b0b7384d58e2c10fa3b56f0635d342abdbcaa52c6303709d2610a6338b0b7a9bf21d83ef25ebabefc1889608dc0c7e0", 0xd0}, 0x1, 0x0, 0x0, 0x4000001}, 0x8005) r4 = socket$rxrpc(0x21, 0x2, 0x2) getsockopt(r4, 0x110, 0x6, 0x0, &(0x7f0000000280)=0x51) sendmsg$can_bcm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=r0, @ANYRES64=0x0, @ANYRES64=r1, @ANYBLOB="3ba930b9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40080}, 0x0) r5 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f00000009c0), 0x0) ppoll(&(0x7f0000000a00)=[{r5, 0x8010}], 0x1, &(0x7f0000000a80)={0x0, 0x3938700}, 0x0, 0x0) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x0) r7 = add_key$keyring(&(0x7f0000000280), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) r8 = add_key$keyring(&(0x7f00000003c0), &(0x7f0000000400)={'syz', 0x2}, 0x0, 0x0, r7) pipe2$watch_queue(&(0x7f0000000440)={0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r7, r9, 0xf4) keyctl$unlink(0x9, r8, r7) r10 = socket$unix(0x1, 0x1, 0x0) bind$unix(r10, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) listen(r10, 0x0) mount$9p_unix(&(0x7f0000000080)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f00000000c0)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000100), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='trans=unix']) executing program 9: nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) mkdir(&(0x7f0000000140)='./file1\x00', 0x44) r0 = open(&(0x7f0000001d80)='./file1\x00', 0x20c00, 0x0) r1 = inotify_init() inotify_add_watch(r1, &(0x7f0000000340)='.\x00', 0xa0000381) r2 = syz_io_uring_setup(0x7386, &(0x7f0000000200)={0x0, 0x86f7, 0x1000, 0x3, 0x0, 0x0, r0}, &(0x7f00000027c0)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r3, r4, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r2, 0x48e9, 0x225e, 0x2, 0x0, 0x0) executing program 9: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=0x0, @ANYBLOB="08001b"], 0x30}}, 0x200000000000000) syz_genetlink_get_family_id$team(0x0, 0xffffffffffffffff) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)}, 0x0) executing program 9: r0 = openat$zero(0xffffffffffffff9c, &(0x7f0000000740), 0x8202, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='maps\x00') mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r3 = openat$cgroup_devices(r2, &(0x7f0000001140)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r3, &(0x7f0000000140)=ANY=[@ANYBLOB='b 75:*\tr'], 0xa) sendfile(r1, r0, 0x0, 0x6) executing program 9: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="34000000010400"/18, @ANYRES32=0x0, @ANYBLOB="2a13020020000000140012800b00010067656e657665000004000280"], 0x34}}, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=ANY=[@ANYBLOB="12000000120001000200000000000000100000000c00001700000000000000000f10"], 0x30}], 0x1, 0x0, 0x0, 0x20004000}, 0x0) r2 = dup(r1) r3 = mmap$KVM_VCPU(&(0x7f0000ffb000/0x2000)=nil, 0x930, 0x1000002, 0x4018831, 0xffffffffffffffff, 0x0) r4 = userfaultfd(0x1) ioctl$UFFDIO_API(r4, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r4, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000ffa000/0x3000)=nil, 0x3000}, 0x1}) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e60, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) listen(r5, 0x50) r6 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r6, 0x1, 0xf, &(0x7f0000fee000)=0x3fa, 0x4) bind$inet6(r6, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}}, 0x1c) r7 = socket(0x1e, 0x5, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000040)=@req={0xfffffff0, 0x8f, 0x5, 0xfffffffd}, 0x10) listen(r7, 0x0) r8 = socket(0x1e, 0x805, 0x0) sendmsg$tipc(r8, &(0x7f0000000100)={&(0x7f0000000180)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10, 0x0, 0x0, 0x0, 0x67}, 0x0) setsockopt$packet_tx_ring(r8, 0x10f, 0x87, &(0x7f00000000c0)=@req={0x5, 0x3, 0x401, 0x8}, 0x10) sendmsg$tipc(r8, &(0x7f0000000580)={&(0x7f0000000340)=@name={0x1e, 0x2, 0x3, {{0x41}, 0x4}}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000380)="9afa5448", 0x4}], 0x1, 0x0, 0x0, 0x40}, 0x8) accept4$inet6(r7, 0x0, 0x0, 0x0) listen(r6, 0x50) syz_memcpy_off$KVM_EXIT_HYPERCALL(r3, 0x20, &(0x7f0000000200)="a403402e6d69aa1cef9ef9a6a8a811114a73630561f86ec24fbd20a00100000000000000a1ea91a3fc852cf7795cc3c0d78ae4de1e5110eafba40d764d04868000", 0x0, 0x48) ioctl$UFFDIO_WAKE(r4, 0x8010aa02, &(0x7f0000000080)={&(0x7f0000ffb000/0x3000)=nil, 0x3000}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000000c0)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) executing program 9: bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, 0x0) iopl(0x3) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r1, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r2, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000010000001c000180060001000200000008000300ac1414aa0800060001"], 0x30}, 0x1, 0x100000000000000}, 0x0) executing program 9: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x2002) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f00000000c0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r0, 0xc02064cc, &(0x7f0000000040)={r1, r1, 0x4, 0x3, 0x2}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r0, 0xc02064cc, &(0x7f00000001c0)={r1, r1, 0x0, 0x80000001, 0x2}) (async, rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000080)={0x0}) (rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000180)={&(0x7f0000000140)=[r1, r1, r2, r3, r1, r1, r1, r1], &(0x7f0000000200)=[0x4, 0xd2fd, 0x1000, 0x46, 0x2, 0x101, 0x1, 0xb4, 0x0, 0xbc2], 0x8, 0x1}) executing program 43: socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x2ba) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="3c0000001000850619fbb7c75150926b00000000", @ANYRES32=r2, @ANYBLOB="fe000000000000001c0012000c000100626f6e64000000000c0002000800010004"], 0x3c}}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket(0x1, 0x803, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) sendmsg$nl_route(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000480)=ANY=[@ANYBLOB="540000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002c0012800e0001006970366772657461700000001800028014000700fc0000fffe000000000000000000000008000a00", @ANYRES32=r5], 0x54}}, 0x0) executing program 44: r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x2002) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(r0, 0xc00864bf, &(0x7f00000000c0)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r0, 0xc02064cc, &(0x7f0000000040)={r1, r1, 0x4, 0x3, 0x2}) (async) ioctl$DRM_IOCTL_SYNCOBJ_TRANSFER(r0, 0xc02064cc, &(0x7f00000001c0)={r1, r1, 0x0, 0x80000001, 0x2}) (async, rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_FD(r0, 0xc01064c2, &(0x7f0000000080)={0x0}) (rerun: 64) ioctl$DRM_IOCTL_SYNCOBJ_CREATE(0xffffffffffffffff, 0xc00864bf, &(0x7f0000000100)={0x0, 0x1}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_SIGNAL(0xffffffffffffffff, 0xc01864cd, &(0x7f0000000180)={&(0x7f0000000140)=[r1, r1, r2, r3, r1, r1, r1, r1], &(0x7f0000000200)=[0x4, 0xd2fd, 0x1000, 0x46, 0x2, 0x101, 0x1, 0xb4, 0x0, 0xbc2], 0x8, 0x1}) executing program 1: r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000b00)={0xa, @pix_mp={0xffff, 0x8011, 0x31324d59, 0x7, 0x9, [{0x2319, 0x81}, {0xfffffffd, 0x7}, {0x4, 0xadf}, {0x5, 0x4018}, {0x700, 0x8}, {0x6}, {0x0, 0x9}, {0xaa}], 0x7f, 0x0, 0x1, 0x0, 0x2}}) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vlan0\x00', 0x4000}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socket$kcm(0x21, 0x2, 0x2) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000440)={@val, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x452c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0xffffdd86}}}}}}}, 0xfdef) executing program 1: capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000180)) (async) capset(&(0x7f0000000000)={0x19980330}, &(0x7f0000000180)) openat$ttynull(0xffffffffffffff9c, &(0x7f00000012c0), 0x40000, 0x0) (async) r0 = openat$ttynull(0xffffffffffffff9c, &(0x7f00000012c0), 0x40000, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000001340)=0x13) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000000)=0x6, 0x4) (async) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(0xffffffffffffffff, 0x84, 0x1e, &(0x7f0000000000)=0x6, 0x4) r1 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r1, 0x40045532, &(0x7f0000000040)) r2 = openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) r3 = syz_open_dev$sndpcmp(&(0x7f0000000200), 0x0, 0xa2c65) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f0000002680)={0x0, 0x18, 0xfa00, {0x0, 0x0}}, 0x20) ioctl$SNDRV_PCM_IOCTL_READN_FRAMES(r3, 0x80184153, &(0x7f0000002600)={0x0, 0x0}) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000580)={0x0, @in6={{0xa, 0x4e21, 0x9, @empty, 0x100009}}, 0xffff85e0, 0xc4e, 0x10403, 0x4, 0x32}, 0x9c) executing program 6: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket(0x848000000015, 0x805, 0x0) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e20, 0x0, @dev={0xfe, 0x80, '\x00', 0x1a}, 0x10}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000100)={0xa, 0x0, 0xfffffff9, @dev={0xfe, 0x80, '\x00', 0x3c}, 0x3ff}, 0x1c) r2 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) r3 = syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) close_range(r2, r3, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000002680)=ANY=[@ANYBLOB="1400000010000000000000000101000000005e1affd50200000009910100f3649571152202c0455b2db439039c73797a300000004605c4804bfb8b13ed61d308f3aa9bb6000800023f3c503840000000032c000000030a01030000e6ff08000000020000000900010073797a30000000000000000000000000009527548e6d23455ec6109007acdb6435444291777945c4dbb5578d8e5c668afc96e2971d6e791367e80000000000", @ANYBLOB="cc74d1fbb7ec0a69168b16174661b70a3cc1acc416ed947d03d0df46e4509464147c0452ae6950edac3bb1e696d69d49fd993da80e1ebcf777d556368652fe659d3b31ed3e980c32b709e8d8e1b468d373da61dd0141678e9a7d3e3c5635a254fd2575e9f2f414563e2467a3e764fcebe90742beef9f206d26c756d942fb6cd80581626e5ea441386ca9508e77f17b5320e62bd17589d9165383e6b14490eceb2de1f7d8cf0b4861849e250e2cf7469fc7aa318be7157a32fa6de02ab2245b120bb1526b85f72a6bcac4ea6f6f3bf23d6e9a6ea61624886b8a9c571ce54650966caccf2725de1220b31547c1cf2e7a890d5fdbf67d8c470a7b83f20931", @ANYRESHEX=0x0, @ANYRES8=r0, @ANYBLOB="dc13536f0873b459e3b198eecccdf95f13cedd0401b2b1968c768d1c32e43d915969bef038fb2fe39859a67a5323f33f024892e0d57243022155a2492f22d4edca8526c24ea302595b8dbeedae4e288cc438967630b2f02f700b3815f5b8ba02b7c4b7dd29727418668731fd8adfaa4bb66c7fb407e4794a148e30e77373f32b115634d74164845a9dad74feb31eb922a968b8c1d146caadb34cebb58787e1640498d4fbc8b58259d861f96342a24603481d1f6c40a445b3a07d0eed5b3c108636c5d68029df606a350f1668af02bd75d228ec44d189a5ce766156dd26f8cd8aa2a7c141a335bf8785bcfcd18308b625af6dfa373e1631105618418e29ab7864d29aee0654d2c2dff7528aa854b7e5f931cfc0428efa194a61e32f9b1f648a05419f7bbcaafbe2c30530a2fbefc44f0dda5d5e2415b8c1d98a3ef6f49f72d82a40d4dc4e8a293b6fe78a93a7ea749b6d959f073f1d6ecbbe1799e7fe92ca769754edfa242596cce211de102569c06f35642a3642d6349b61c66307dcdae2131ea815255650198b4b51fea79a38127824c3318aa96b2b2da8c891aacb4bbcb4fb07037d121ceb4ddea3333c55161e650d4f939e0ef3eae608aaa53fb00627bf8d4f78068dc0c15c0b3db31ae049f3bf32ed96dc5755b80b0012041ab6089bfe39039e86210090d51aa21ae07215ea27d8e3cda884128648d234824b0b7b9f83e1d23fcdd1fde7fba5a3ad276d9239ea45022ff653411a585ff6f34eaf58d4fbefd7cf58ac59f917c88c4601964300d1b628dac88793c7523e6edd80b7aea8285464c57cd464fff7fc7cb184d845286dc5d50968a25f28e0959419abb1f8e9f77881e90e10b3d1c7ae70b088b3cb8b2a896631f2fbd6d72c58599efb430aa651c99f231b6f3d061834bb6cdd5affcd2215673bf6fbc8941caca1f447d6bc0cff43aaeaf4d94c6d848935867f5919744979339d7aadc40d1abdeadb49310dd1211cd20771c88068034c8fdca2c98fb17376facf2d0d72390c719a6d9b8e543c1ed089226d1dbcda13a9ad8602cdd4c2bea8a1bc605868ca3e88678dd067faf74f2b70b8c8703995e021332de58daec2a3cbfff1ac0d75439b9c22b29a82aaa3bf200bd8af2033a1848e6f0d5cfdb11649cd18c3132935ffc88d2ae223288f118b745eea1b6cbd524ed7fb6bae04bf64cdd8c15efcbbea960f4d15bd3fad83bd8c405fc310bd752107d8e81ec1ff69dee32847412c9c0acc1b2992a04ba71856916b29e2ee9cf7b99b3288fc99ea0859b32c26fe473127ffdfa373b1617dccd8f863ea4389812504040337349c324a587a94e2b2291147172c9b221d8511238f0b9d662dc1a04391f02b9cfb00b2f17d078647084947fd1ccacab096b87daca2cf1b8c20257d26fd855e6f4208d3a0cd61e20213cbd948e982db3b57524e8a89bdc5ab1ece7d43b5a9e1bca3e2e7865f059fbf0fc6bb5b209d8ac672deecb56e50f344057f6cced24fd8503d93e47669d6adb6e73005d83ea2969289c36599b04f4d6b9fe514b90b1a6aa80a553913b6e96e41076e2ef30625825a46762aa44245a0188f30faa3e63bb3fa3c2bd2e66e038f6f561751d7cd81fecc36cd1ad464cdbaf8a0ed85962295a76f93368fa8ea0db946f269816349f8090f09b3489330ad17f1a3d2ab311efc5c55f78aa6a53a9ece6c52e6e8a9069a981ce2e6951c42d1fb7ef0c2dce20ec69c4caad0519d4d1971ce5829987770ea49ca973e0a594346a6a96278874d155085378ef0b84aceb83757831bee1242aa2652b718c4df9f100bccf6ec1846cd73b862bab16bc2d303f16326cc938b5e7293bd06d4f0b9a87cd7a630d747245e6d2d66693c6d9d28e44ac27113f1a6db43ea46ebcbe72094395fcf2404ecdfece84f1d955798275758f109ccf74ddef89381f778724f3063e25a260977a8c4d32758b040d325ed470e4492c49ca63d3e825e6695bfd676a68e0e681e774af35c5bf00b29347f301e31e67e0cc923845eafbf8a93bcc5a0335e6ca3625f27d4b121f375be0e72ac60096f76ee5ebc41416c111a95a50e63327afd917d105b09b0de82b6dee24f73ff6a193daa8dcca9fe38583d9752e9a82eb94353bdf5205212a27245648146640c6f6ca4f1939f862db9c437980bbd914331a27be00441f21646e15befe9631d5a34f3bdf6073430736996d5e8cbd4fbce706a1f25c610257b890e8ebdb9c66dc02ec3e0ef78d563ee281dc41fe6e8106d44716be8ef39ef2b39b22c4ebe6cb582773c739bfd4dd662c723a770e3e122e51d040fd74a3b0387d95024da5ff8ae3502a269ecc5d3c8625eeecb8e2c88933d3a534a11316b788d17d39bf979353f4c5445f59924508995f3ee79ce8ece2f806b9d856420832e9ec958cae0cdd07c8aa19f731291522df9347b39ebe9b2b5f20122fea6e901a37df4674d46678c7c67c2ea54a9cee8288aaeabb984f9b6b341b963b92a3024ee3fa6a7ec7427fad3b5e7ff36bd3e586a4a1bb27cf8ac14771124610f779cc5be82890fbcc13eb1f82f119ef561c9ad478cae63c4418405a5ee56b3e47fd3ea43f610b541a63a682215403fc248bd3d810fc453a5cdc81209b367d8265876c5eab4735fabb5d831b7c8a49bf487d6017c9a518b6a44139e0cc68d433260b3441b4a1a2ade58dca6b425d7802adc6bd599751b9656f9ca19a12b0da8d24133e931358fc55708fbc9b17888fcc45d03d746bc775ebe67e19aca79ab2469fa85033c72e51183d066b626887174697db2ff7cc220c0d13c2ffd335fe4c8a9ebba55265452e4bb0d11d6f9c43693e69b4d273f25db5bfc0c1cdd320b752a09cbf4c245847bb9d4ee032ad4e4273770834db4839eff303aa939c82e32228b6295e4130a8b3d90718a6b587580819a4f6e33de062b94a4a461cfa2e3732da31b06bcd35e260f6542a690f7041007935d724c7de87b4f4d4d938fe297db5894fcb869104f23820ab727132c1f78200cc9baf8fdf3a478abf8b6726974e96b1f7cf9c8c917c37cac7b53a731f841b94b3a3a94e4b784e0f013a92dd774258ff6a5f0ec90502284aa540fbf38d9d0eeed984a1697d85a5253e53df10c36f6e9f3e5b396f3027f6fa3ad7dd4961c41b51fbf67485c6503968c8167b1889c438c814cb3b8b5875512449b3135de3335014eb56fbe82b785431e72e796a413331780a51707c5b457f9775576425b2a87516ac32d1b7e583972f48862bc33aa4081ad9b91077c534cf7c9100779b652d0d1959df3e8120d3f06777c5b3c214a76a38041396fd75bfb92e1ea0ced4c09a55d824deaeee55e0dd1c8e93b5d4339be73c1bd8d963bbc8e223bc1748e63987fdb8f513b11d35a6bd6fe02643c8a3e43da3083667fb7807db3346c37676b998587618145a61056c62640edff594c1f4ef49ecb0d24d7dac83a21964d124fedb464523f632d6d9f15762a771d22c8eb41a914450f10014b4cbafe08bd6ea8d5da92de7abcb5138d540bd9e8c01ce05caa85e77f73ab63a67f2e74e55e0d66ae73c4b65db888512ba3ec693e664ad60941ded490e859efb8474b9a266eb1471c9c30dbdda9ef4d812bb5b8de37110cd5d6abbb65493057f13d4af5c5ef19e2bb1bb5eb2a4d90833e740dc8064005ac1637987b8058490f675f23c2848e3136e5810a891b8e60affc37568eee06ea20587fd0664d41ac3369d9c6a5b7ed65312860f5e4440b4219d9bcbf5ce4fb3dbc95ba0a3e24364f1c5e98fc48896ebcb10bc0de299eb74585e2142158963cd94bdfc729a3673e190536652b69e67ef75e5d27e25210188a0d53291587b4262faa2b4548610aa9737d91211f2e518b4a41410b4d73ce3e0c03a6c4f7b2b47b27e39141fa0ed74285ccd70a00862d8ff1152216f6bf22135763e78670411e1235828b3d6a69a74a48d974af4d4179fd9e23a7f82e761ea680314a0a9a30d7177be83e068f158f749cf1cdf0cf6235b2cd2d4d8af56b22ada6965b87cacc5c7777b525489c029fe20218d950b9a8f93b1e39e218864dea3fdb0194aa7d95aa1a324569fd02afa122541406f6aeac05316114a7a9e9949369c0056cdbcd4f0773201072aa0d91754b879666d186cf645eb28f8d674fa8310d485c5b650f78a3c6900728ae4020630d8ea08074f60b648389e3f13c49768d55247712072e14a444c2301cd1e8a0dfa753479b7565d7fc4389c82906d59a9d1c7ccee8682022928d1689851b3bd0d94ef58c8159f863e91ce7c16919a27c547e53db93fe4aee8686dc116316b4c1cd46eb322b22a8068f31622237f090aacdd5b8e8eeebd9c45f9bc68a64500c74852fa8cb7d0409a3ee46c050c3d0e509d144882a45d9cab72352932ad8d37274dfcd104d168afcaf2a6add2528e9fffaba28342ebbc5baf70f4312287ac0ec1636432f9348df44a4045b624fe199d9df589070d640bcae8ce3163d36ea53644fdec4c1b143b7d1923e2156dc2b279638df06cec50a73998c10690ac8c725e2d0017b1cafbb7e289407d5fc768832385caec3bd8bd7d603e4124ea4e162c2a397b83a898d50d9ace5020a75ea9012b52cab22c12d035ad249d239ff1e823444fad0ec38db66e4b1a9904f3f22496445da881fd3d7a0a3b28fa0c368c68892bd09ba6d838940be67316d7de539384668c5da57543e5c41a95c2cbfdc8d6880529b5340524a090e192b50aadd0796b2c3dbb392324e8f74b6be1e162a5291bddebc4c56115f344660f7461567b541cf9294883731f8d486cb1ac260ec69639353a6440301a8dd080733f4ad67b920a9370abcb675799ee3101cbb7f44a05671af6954f5823ec60f1fe43fb1448bc1e0bf87fc845a1d380d842e09b5d67c24c82a351ae21ea716c31c93c72fa2ede04d73cd10dc7cb1593914d2ae391a66738ae2da7e03d8c4818683081674634b8b4c5637017840f5691e28b459221ae8959ea42a7833b827fe892a36a785c98c85d2dd760719489341755d5470215667d08a84a8e716c0534c96ae16122aa75903d1084b5fdee495906fd30b752fad020a21e6486d2d9fefb4c118a69fb68705943d1aefb7d00e3bb22a30acb866336323d1839d2aa81fb4a888d89fda05d7936b3439333a9f32a45e7f35e67e2327cbccf6915fdb73695c1a7c8c5a4c24832459f33d207cfcebf093b7cd66cfbb37cc092d1dbd396582f27da786fe637bcf07703b7b80addd20c81791c64336d2db1c5e33549e550dd170a735bdae98e7dbff6523c3e45d4f10d96dd0ba2bd7d9571daecd63aa113f70c5909ede182e1189fc004c6a3b6befd918802f12661e53ab4e9fef9b35fbc22a83ad3bb066d5afff46102bd6833047f9c29b97153aa0b24d90b268a3dff224c904116909642a6c97de9a09e6336ba5a2982a4f7bc165b60b091ca669c185e86c356e3d54d516eb1a3e15bf4e916a2e5ba24a860aebdf9fd40a3ad838ebdbefab741f63d3c1fbf8887dc768ac0bbcfd80c0575a17796343cc5f25293df4a0be297363c5b0a364635d601134bb6bb72fb1c59dc4d8b91a28b2eca4ab8e9061ce47f5ffade21d11acc3cd7ecc09d04f6cb312673365a5148dce61c44ff7c8d7bf3d540f77880d589e881cebf1c8dcd58605a6f6734f7f0f85503f92b9ca07e75ff8ede27504afd93e9378c6e5d7206186b80ea8a1ba999872b2df6dafb5bf30ee2d9f28a014521762df6c2e5e7698b956df62903169ba1cac2b230f3a61f1654eef1085b72add6a43a02ede2636b3bb6ed5223d263bb89e45d30a697de465", @ANYRESHEX=r0, @ANYRES32=r2, @ANYRESOCT, @ANYBLOB="ccdc5a16ffae108a611df53390", @ANYRES16=r0, @ANYRES8=r1, @ANYRESOCT=r0, @ANYRESOCT=r3], 0x7c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) socket$can_raw(0x1d, 0x3, 0x1) memfd_create(&(0x7f0000000140)='w@\x00', 0xc) r4 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_RECV_OWN_MSGS(r4, 0x65, 0x4, 0x0, &(0x7f00000000c0)) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0b040000000000000000020000000900010073797a30000000000900020073797a320000000014000000110001"], 0x54}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES16=r0], 0xcdc}, 0x1, 0x0, 0x0, 0x4000011}, 0x10) executing program 5: madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0x6, &(0x7f0000000cc0)=ANY=[@ANYBLOB="050000000000000061110c00000000008510000002000000850000000500000095000000000000009500a5050000000077d8f3b423cdac8d80000000000000002be16ad10a48b243ccc42606d25dfd73a015e0ca7fc2506a0f7535f7866907dc0200000000000000ae669e17fd6587d452d6453559c3421eed73d56615fe6c54c3b3ffe1b4ce25d7c983c044c03bf3a48dfe47ec9dd6c091c30b93bfae76d9ebacd3ed3e26e7a23129d6606fd28a69989d552af6bda9df2c3af36effff9af2551ce896165127cb3f011a7d06602e2fc40848228567ffb400000000003ed38ae89d24e1cebfba2f87925bfacba83109751fe6c05405d027edd68149ee99eef6a6992308a4fc0b7c70bc677d6dd4aed4af7500d7900a820b6347184e9a217b5614cd50cbe43a1ed2526814bc0000e9e086ce48e90defb6670c3df2624f56da648d28ad0a97aec7291c25447c106a99893e10db21901eb397b2f5fd71400fa7a050fbbef9e326ea27e513e96068fd1e8a43e89f9c85c822a961546ed5363c17ff1432d08806bc376e3e49ee52b59d13182e1f24ed200ada10eb1affb87ba55b2d72078e9f40b4ae7d01000000d11cd22c35d32940000088dde499000000fdffffff00000000000f000000ef0000000000000000000000000c52f4ebd2c893bb97a068bd10734a83584898eccb26f7b789cfc4cd995fa3e11a5c74c85404e2df3ad37b729ac83b0dcb4f48f3c3356b9997fc455a17690b6f7f9ccbe4b1701941b18aba6b16455a66c3b84b138efc20a546d3d5227e23b03f2a834391ade2ff3e93ee296c4082ee73e7c353312c9d75711ce1623e9c54bdff59d2a69dcb7d84c235b23a4480c2461b405cfd1a38992f295ad3adc94cd07c850d1ce6d0b2fea02c24e9280333152fb794e4ddea02017a6c139b50101caecaf2abc0847a1ff2f7fc3c2b99a96fc4275ad107274e2934a87a4ddcdb112754ca5bdec0ead14b6c0f19a43a2f05c7f0be31491eb8c9ff68236c8600040000000000000000000066e034c81c3cab64e4fc8dc55ce0ada18dcbf31c6e82893add3bee3e10fc873d1d922b0877cbcd95b839d3059d5140a1f742f6e75741e39e5cb6a193e06a1043375b0f61b5d4e17c81baa31b924d84f224baf1221c15fa12313ffbfa7c2730309f66705b71e6205e7cbf3643561eabb9a63fcd604d5cc27e1317ad94cf438d71873e540be16b6ca205081173bd03c4754fc4674812daab482fd390a1c903b5d28a1eb247b5837d7603b92495d5c569f6433c3fca5206cb0000003fdbbd3892c52c2e7612e05de32322e980a3d69931e2c9312dd517c96f2ee90362476ed853c4c9b7d4ebf13cbaa795860e92a3d7d004f2c491db38eb769f094d5d48b262cc35c40682138cf13a49aa9f27abec00002f01ba1251aaf2385416ca719300"], &(0x7f0000000080)='GPL\x00', 0x5, 0x29e, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) r1 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r0}, 0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x44080}, 0x2) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000140)={r1, 0x34}, 0x10) mlock(&(0x7f000020d000/0x3000)=nil, 0x3000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=@newsa={0x154, 0x10, 0x713, 0x70bd26, 0x0, {{@in=@loopback, @in6=@local, 0x4e22, 0x8001, 0x0, 0x3fff, 0xa}, {@in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x32}, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', {0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x400000}, {0xffffffff}, 0xfffffffc, 0x0, 0x2, 0x4, 0x2, 0x2f}, [@algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0x7, 0x4e28}}]}, 0x154}, 0x1, 0x0, 0x0, 0x4054}, 0x0) r1 = socket(0x10, 0x80002, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010e7010000000000000000000000000a20000000000a03000000000000000000070000000c00044000000000000000021c000000090a010400000000000000000700000008000a4000000003"], 0x64}, 0x1, 0x0, 0x0, 0x4004001}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x3c, 0x10, 0x40d, 0x70bd25, 0x25ffdbfc, {0x0, 0x0, 0x0, 0x0, 0x10}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MAX_AGE={0x8, 0x3, 0x19}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) sendmmsg$alg(r1, &(0x7f00000000c0), 0x492492492492627, 0x0) executing program 6: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) ioctl$EVIOCGUNIQ(r1, 0x7b9, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000380)='memory.events\x00', 0x26e1, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="10000000040000000400000001"], 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000a80)={{r4}, &(0x7f0000000a00), &(0x7f0000000a40)=r3}, 0x20) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000500)={r4, &(0x7f0000000400), &(0x7f0000000440)=""/180}, 0x20) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f00000000c0)=0xe) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(0xffffffffffffffff, 0xc018937d, &(0x7f0000000180)={{0x1, 0x1, 0x18}, '\x00'}) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r7, &(0x7f0000000100)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) ioctl$EVIOCGPROP(r6, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCGFLAGS1(r6, 0x80207450, &(0x7f0000000100)) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r2, 0x4018620d, &(0x7f0000000100)={0x73622a85, 0x1100}) ioctl$BINDER_GET_NODE_INFO_FOR_REF(r2, 0xc018620c, &(0x7f0000000080)={0x3}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r11, 0x4020ae46, &(0x7f0000000180)={0x0, 0x1, 0x100000000000000, 0x2000, &(0x7f0000000000/0x2000)=nil}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)={0x2c, r8, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_TX_RATES={0x10, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x5, 0x1, [0x4]}]}]}]}, 0x2c}}, 0x0) r12 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000180), r0) sendmsg$L2TP_CMD_SESSION_GET(r0, &(0x7f00000002c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000280)={&(0x7f0000000200)={0x50, r12, 0x1, 0x70bd2d, 0x25dfdbfb, {}, [@L2TP_ATTR_RECV_TIMEOUT={0xc}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @broadcast}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xa}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x3}, @L2TP_ATTR_OFFSET={0x6, 0x3, 0x80}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}, @L2TP_ATTR_PROTO_VERSION={0x5, 0x7, 0x3}]}, 0x50}, 0x1, 0x0, 0x0, 0x48045}, 0x20000000) executing program 5: r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000b00)={0xa, @pix_mp={0xffff, 0x8011, 0x31324d59, 0x7, 0x9, [{0x2319, 0x81}, {0xfffffffd, 0x7}, {0x4, 0xadf}, {0x5, 0x4018}, {0x0, 0x8}, {0x6}, {0x0, 0x9}, {0xaa}], 0x7f, 0x0, 0x1, 0x0, 0x2}}) ioctl$VIDIOC_DECODER_CMD(r0, 0xc0485660, &(0x7f0000000000)={0x2, 0x2, @stop_pts=0x4}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x243, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r4 = dup(r3) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f00000002c0)=0x10000) getsockopt$rose(r4, 0x104, 0x7, &(0x7f0000000080), &(0x7f0000000100)=0x4) executing program 6: r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r0, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, &(0x7f0000000180)=0x8, 0x4) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) sendto$inet6(r1, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) sendto$inet6(r1, &(0x7f0000000080)="a2", 0x1, 0x8880, 0x0, 0x0) sendmmsg$inet6(r1, &(0x7f0000000780)=[{{0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000380)="bcb832ee", 0x4}], 0x1}}], 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='cdg\x00', 0x4) shutdown(r1, 0x1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) r4 = syz_open_dev$I2C(&(0x7f0000000ac0), 0x1, 0x0) ioctl$I2C_SMBUS(r4, 0x720, &(0x7f0000000b40)={0x5, 0x0, 0x1, 0x0}) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = msgget$private(0x0, 0x0) r7 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) lseek(r7, 0x7ff, 0x1) getdents64(r7, 0x0, 0x10) syz_emit_ethernet(0x14, &(0x7f0000000280)={@local, @remote, @val={@void}, {@generic={0x88a2, 'f\n'}}}, 0x0) msgrcv(r6, 0x0, 0x0, 0xc44a81d1a42f846d, 0x0) msgsnd(r6, &(0x7f0000000140)={0x2}, 0x8, 0x800) sendmsg$nl_route(r5, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="280000001e000100000000000000000007000000", @ANYRES32, @ANYBLOB="000002000a0002"], 0x28}}, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000700)={&(0x7f00000003c0)=ANY=[@ANYBLOB="34000000101a1fc549df4193c25bde4128a69e52fc07431be8cd7a517196cafc54fa44211a51bda838506e8487e5bc7521a74baba4c68c3827836d8979f58e08ac4c722e58ee045b8a258e6fcaad59fae9af3304c80345adff033a4de8f28aea725e43d1323a57897f7b32e976e016d3cf5f4f25da2cf75fa844ad9efe95b57171062163990aa8d011d2a6ccea75b93a020324a8e46655e4fe39137f18f38b789d11d6f6ebdc4c5185eb6e", @ANYRES16=r3, @ANYBLOB="010000000000fbdbdf25250000000e0001006e657464657673696d0000000f0002006e657464657673696d300000"], 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r8, &(0x7f0000000140)={0x0, 0x2, &(0x7f0000000100)=[{&(0x7f0000000180)="5c00000013006bcd9e3fe3dc4e48aa31086b8703410000004000000000000000040014000d000a00100000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001000000140007000000000000"], 0x74}}, 0x0) executing program 5: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000000)={'vlan0\x00', 0x4000}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socket$kcm(0x21, 0x2, 0x2) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000440)={@val, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x452c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0xffffdd86}}}}}}}, 0xfdef) executing program 1: r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000b00)={0xa, @pix_mp={0xffff, 0x8011, 0x31324d59, 0x7, 0x9, [{0x2319, 0x81}, {0xfffffffd, 0x7}, {0x4, 0xadf}, {0x5, 0x4018}, {0x7000000, 0x8}, {0x6}, {0x0, 0x9}, {0xaa}], 0x7f, 0x0, 0x1, 0x0, 0x2}}) executing program 6: syz_emit_ethernet(0x66, &(0x7f0000000040)=ANY=[@ANYRESHEX], 0x0) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f0000000180)={0x53, 0x0, 0x6, 0xa, @buffer={0x0, 0x0, 0x0}, &(0x7f0000000000)="1201b0008000", 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20042, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) syz_kvm_setup_cpu$x86(r2, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) executing program 6: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000039c0), 0x0, 0x0) ioctl$TIOCGSOFTCAR(r0, 0x541a, &(0x7f0000005480)) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000080)={'team0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000003c0)=@bridge_delneigh={0x28, 0x1d, 0x1, 0x70bd27, 0x25dfdbfc, {0x2, 0x0, 0x0, r3, 0x0, 0x71, 0x7}, [@NDA_DST_MAC={0xa, 0x1, @broadcast}]}, 0x28}, 0x1, 0x0, 0x0, 0x4c}, 0x48010) openat$pmem0(0xffffffffffffff9c, &(0x7f0000000000), 0x80, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000380)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000028c0)=ANY=[@ANYBLOB='0\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r6, @ANYBLOB="1400238008001c000400000006001000f7ff00006bab80d21096cae0b7ee34f1cba403aebbf4dd4844f2005e54daeb461c5c303008d6ebfd6ff1026b15c4bfd0"], 0x30}}, 0x0) r7 = syz_io_uring_setup(0x6bc7, &(0x7f0000002680)={0x0, 0x2ef8, 0x4, 0x3, 0x272}, &(0x7f0000000040), &(0x7f00000000c0)) io_uring_register$IORING_REGISTER_IOWQ_MAX_WORKERS(r7, 0x13, &(0x7f0000000200)=[0x80000000, 0x810], 0x2) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r8 = socket$inet6(0xa, 0x1, 0x0) r9 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r9, &(0x7f0000000000)={0x500, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYBLOB="020300090a0000000000000004000000030006000000000002000000ac1414000000000000000000020001000000000000000002fffffffb030005000000000002"], 0x50}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@mcast2, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x0, 0x0, 0x1}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.io_wait_time\x00', 0x26e1, 0x0) close(r10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)) ioctl$SIOCSIFHWADDR(r10, 0x8b14, &(0x7f0000000000)={'wlan1\x00', @random="0100008dff00"}) connect$inet6(r8, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f0000000c80)=[{{&(0x7f0000000040)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000180)="fd", 0x1}], 0x1}}], 0x1, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f00000002c0)={r4, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={r4, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32, 0x4}, 0x9c) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newnexthop={0x38, 0x68, 0x1, 0x100003, 0x80000000, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_UNBALANCED_TIMER={0x8, 0x3, 0x3}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048080}, 0x0) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000004900)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000004c0)="cc", 0x1}, {&(0x7f0000000ac0)="4e9dd319954453cfb964069ecd1e9e57f63f624a199c52d0c71dee297e3cc62907abd41ca061e83e7700876b8f6e5101c3cfc57a91e526f1114f3a24deb15bdc1ae3a4997defba7e8f54671921ca19354ecf9ef4ac40241e6b64006b1384c61f16bf71c22442de77e258c3b4e207d23cc92e7e3dc2263f662c1ff3cb3a0c3c8bb55725268a5c2ab5e56a8c4dcabf68f9752d4e403cefc66d46b3102415fdd39b1b6986be0f8fbc84414f5bf88aa16e962fdbd7bfd639bad83a507096a6e33fa26c296e2a", 0xc4}, {&(0x7f00000009c0)="cbc0d4c6d51135e674dba57d6ed2ddc12056125b0ee224059bbf1f648d3fa32b8c0565f8cf4476f3709c4ed60544b2430349014358210c255a7d8096eb553abab27c0ac83dc82625d4fdb15e93956483c4", 0x51}, {&(0x7f0000000240)="dabd58f0f476e1ee724050b11a34fb50bd7acdf8986a1bae5a6171a631e4ee6ce1fceaf3265694fa6c47559712e4683ebe7eb22cafe9b4e7d4fd9aedc49b9270e7a28fc6c70ca89b44cf10d87455a1c34c9c3671d9cf3a62d0fa1c14e41337b865365d05cab609e6359cadf7f8cb428422e18608aa775f8672b75e064b7634da1e740901cb364157a07b5a46bd94e80e75fd8b4bf6d1f5ea80156c990474115f68c565c5dcd8247d071dea9036be90096250304c76b78f01", 0xb8}, {&(0x7f0000000a40)="aca011498c4ac0b7f827ead24cbde30a1c401d69bbf00e0d63a3490cc9754869c64486b720e5def9cb9affdde4ced0fe0776226ed8745b35977d4fcf442f291dd74e3467a653acd1cfb4efd432d01d610486781db3dcc332f9b252a5507c386aa6", 0x61}, {&(0x7f0000000000)="a8881b4a98f50a234d9d8fbb5ed492ca94dded781eb4c44e84862c0aa48b0f06a53d4f74db01e8b7c8da032a1915704ce1c077b7b2a1c7e22786b38e44189f4e85b3f1073198a6ce8162d89cdce40891c4d362cc5ca5fbb8e660700a538d015988b6815b9d46ccda9e368c1fbc8a389adc0f421f38468a163ba8765e832115f61b042405278bdfba3a79cfda3c8453d2b483b9f872a3492e69e81a", 0x9b}, {&(0x7f00000008c0)="2e8dd0eee2a97f0dd0cbd80505ee0793e2b0aa874c8ffa76d69cbb088bd641c792047e589bd703a6befa1b46e1f895a6255b1d349a431005a1ef67cb6e1e7f5371b51ef8728c5a23f9d7346aa54ca30ffa29712f6463eefd1f2e2e0134c8a1ffca3ea413bb66c82ecbb114b125acf0144df3164d2653d5b616c3c97cc53453fe4cdcf954774147fed45ccbe9592c18848c7e454efed4eb32aaead3731cc9b0086a82133c6b7a4823d9ae42917f192cf0613c4194e4a1d5e3fd3eef855441d7298283f0b175b9af48a846944aa5f2dca16e5236a89f1c1306945bc4b895420b6bc64691cc86566f064f79cc", 0xeb}, {&(0x7f0000000440)="47b3be7a75f09a20302a26df27d2efe74c6c022a3dbe537ab15d7cca1666e8397decf681f573dfe4399c8a797453a8350817fea1b2adc9963a0a07e373fad1322102d75deb3bb93403a49fea1c5463fa1ced34db2bbf4a", 0x57}, {&(0x7f0000001080)="1fc09a390764166802fb41e3732a9f21408e5f97c1b811ed3f34f2dcab80f127ba1b74bf21ca369777b9faf02771a5b31ec9111c36b14c308ba794002caad7ab2361476fa0d269ca75210901fce82996dbd9a76cbd0085fbca35b49b5ee88cb23740f668fdebca91a7c153c170e0929c5de8c56f49e51f2e4700bcd34b355c18203a80ddfd60f478ff48c257c597c30c232924b05e5119acdcf61372a43bcfca60bce159dcd9077ba57b630d279859b236073a163de3b39e20fdc8428afde11d4ff26477b6ee9830d9a1c8aae982bb0c83f4f3adc685ddae903a9e4023f63f4f3bac3ff366a950b997116160ce22558ad42e43580512438c9e11e6f6b8ac6407407d9c39aa609d8c267a907228a5ca6111b405f09bdcafbc3bfb7e52c2633fd20e969348ef08117259acc953652a7a988a461a5629906c1a36482b5f2d784fd926c50c83f92117950a8551da6cc69351dd7d117719253dd2c041686e99577a92894456377f0c0458afaa0275206b4678abbbe6bd852392a24360f1adbd742b0d712d9318a9d93b2d5ef49e5de7cd5f0d35ccaf9676725fba524086131108d168a1952d626a5ef80bfc0b340262faa8d6fcec328d690266a84557a155943dc893813984909ac41adf60e8fdb7fe7645c9d7f6d5e14d603bd12dc90e5d752b7fb2c9990b2bc123729f293752509f575e4577c068f446c11fc53fb25c9f97076a5121618f72b04cc5020714028017e9d68be767508c21f7cc9fb76439e4edd903472b271bed2a19c9a53d306f5d36fc00ca4b82e93b7ef81f0f140c5993e9a035817bfe41ec894b9244772284e493311cefc4431a6f7e160e4c7035459c554bc5b31177b618db308d3fce0124db993979ba20e9db17f090fa438ca187adf5129301931f7a0787bcba095b3d50181f62284ad68349c9c9f50ac7d5f3f5cb08be78826f7c3c5068df3cd4db5c4283fb3b9ead414801ea63f059c340b0a693eaeeaddf17f3542f7933930e6a9918123526d9267b46a9cd76baf361df1cbc49ed5b8f650457d4d24142d83b1aef21d4f43837a2dced49697cdbcf4e963caaf68b6f22be01591a45ce4e3cc541a2c08338f0baa1585b78cd5564ebe500cf578c7ef806267d4bde067bba28a5417f0f2366a9e5873b1ed5e27307c75ae0dc719254764c3c778b7650e5cfb1b721766d28b53e2b09b0bf5747fecdd731555e183c91", 0x35d}], 0x9}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000500)="bda033176eb146b36ef41f221a4e7ce48b2598d750606488520915c6806affc0a913781c7211ce1fcd59a12b5d5afdaf9d723f092ce9d1eed16e208f2e79831ca049e8979ad94621175c2c48c10e33b29f2def51498743b057efc21efe4be4e5f02e9d236f27190c29c5da0f3799452f5e3640340502fde4ae8c56b303e1b79b3d1842bf6277771bef544c745e7a80c9e7efdd1c619f69b9d01839aa326776d335689e4db7cb7e32fad8f4c40e943b43eb4ea173d720bf5998149625a731643636c8ddbe61e1d7d4736f8414a84acc40557012c82697d8a59c873424aefb3c7ff0dba302efaaf887a477b1ab7ea6c1def9db3514e444c1ef36c6cf42cde90d4bbb2e9a3a5d16a1bb191ad91cab867cd55037d507a12803f3df1b81f1857fad085dbc5c46aac14230d7a4f8b36d6bc63b4a16cd309b7697b421a662b83001b5ce5ab3ff80800243107df7aa6cae9a5db6a8f2a53ef7d6c6aeac76b83a15466c74a9cdbcde8505e3d14c0c3a47a36bf464168202dc88e25f4c1da57faf0eaa7ff16bdd751c2ae5778e169c8ffba57c9a20e24ad51e6e8e02b721e8ca94f131cc98e03b34b615a1db4080362de4ef215d5a0541aeb0c742a2636ac5af8538ceb3585ef9dca8037df55baa072096073b005b53eff0b899de59bc2b5d687d109520571eeacb30124c4012fe6cb9e3bf451be3d219206ddc35099101533cff5aee6c4783e00e6dd391f664052a6c66c62f62a49fde8fbe336543bf99b55e53b801e54c1d0a292da83db26a8a870ac1d8751c4bc0d495277295cd3a17f9e9a25d70214a17b981b62d5c75356ed025df3557a8b59648edd9d1dbdf169d91f9d85cfac11a57db0a14d33e8934a2cc98d389912a0d9942a40c3ee98d35da61d3bab1a32c9d788e9f74ee57012ca5bfd0dc090b591c64aae6a205fbd349fc372bbd7429983a69cae26ff8b5b019144d318ba225e46bc6cf8d7d3e5952333042542b2fd4fb4d88a3651dd8e14ecc2845d4e71f7dfd128e9e2ee2ab0062a3e701bb2477bfd73d7396ae522f11fa481078d1c7f7905e0846fb072dcf7c06102b3816ec4a3518514c7166d7385b680469f5184a93953258952554e68d93ea8f789c4f13982b65996d7d9cf19f0b39b72e1dc9079d84413bbc30d24fc481e24ef1beac020000000000000084d16a1c71b2c8a568481f4f1b254ccd66fbef4cacfc3e13f2c943a264e429824bef7297f93076aea55ed9cf12512c14ac3df331695024bd1e53369a87caf6894fce81594b43cb3dee05ab21", 0x38f}, {&(0x7f0000000300)="d8fe61cb28d9640d540c44cf98f32ab0975835e26ef8b3d434cb3d6fe6191cf7cb16c54970bbd8ce2b339ed8ca4fea5342c2bdc0f51e90ab1f8e28a1d04977ef48b42de3bbdfa152333d297fbeec0cbb4cf252eb909a27a5d47c0e37822213b2ea5789c033a030fda0d90c1f0dbddf59744cb991868d839bf7d800421e54", 0x7e}], 0x2}}], 0x2, 0x4048884) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000180)=0x10) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x4400, 0x2, 0x0, 0xa55, 0x3, 0xfff, 0x1, r7}, 0x20) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) executing program 5: r0 = socket$netlink(0x10, 0x3, 0x6) writev(r0, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23ffbf510040041feff5aff2b0000000000000700"/68, 0x44}, {&(0x7f0000000080)="c1130389", 0x4}], 0x2) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x50, 0x10, 0x401, 0x0, 0x3, {0x0, 0x0, 0x0, 0x0, 0x32b, 0x28000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_PRIMARY_RESELECT={0x5, 0xc, 0x1}]}}}, @IFLA_ALT_IFNAME={0x14, 0x35, 'bond0\x00'}]}, 0x50}, 0x1, 0x0, 0x0, 0x20000010}, 0x0) executing program 5: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000b40)={'dummy0\x00'}) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x40, &(0x7f0000000840)=ANY=[@ANYBLOB="78226e6f65786163638173733d616e792c63616368653d66736361636865"]) (async) chdir(&(0x7f0000000100)='./file0\x00') (async) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x2) getsockopt$ax25_int(r2, 0x101, 0x9, &(0x7f00000001c0), &(0x7f0000000000)=0x4) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='pids.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x4000) (async) write$vhost_msg_v2(r3, &(0x7f00000003c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x3}}, 0x48) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r4 = dup(r1) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) (async) syz_io_uring_setup(0x23a, &(0x7f00000002c0)={0x0, 0x4535, 0x10100, 0x7, 0x0, 0x0, r4}, &(0x7f0000000080), &(0x7f0000000480)) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r4, 0x84, 0x1c, &(0x7f00000000c0), &(0x7f0000000140)=0x4) executing program 6: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000140)={0x53, 0xfffffffffffffffb, 0x0, 0x1, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x22000003, 0x10011, 0x1, 0x0}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) executing program 45: r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000024303, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f00000003c0)=ANY=[@ANYBLOB="000086dd0000120000000000000060ec97000f982c00fb8000000000000000000000000000aaff02000000000000000000000000000129"], 0xfce) r3 = dup(r0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r3, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r3, 0xc018937e, &(0x7f00000002c0)={{0x1, 0x1, 0x18, r1, {0x4}}, './file0/file0\x00'}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="600000000206010100000000000000000000000005000100070000000900020073797a3000000000140007800800124000050000080008400000000012000300686173683a6e65742c706f72740000000500050002040000050004"], 0x60}, 0x1, 0x0, 0x0, 0x10000}, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='mounts\x00') read$FUSE(r5, &(0x7f0000000980)={0x2020}, 0x2020) write$binfmt_aout(0xffffffffffffffff, 0x0, 0x49) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) recvmmsg(r6, &(0x7f0000001840)=[{{0x0, 0x0, 0x0}, 0x1ff}], 0x1, 0x40002000, 0x0) setsockopt$sock_int(r6, 0x1, 0x23, &(0x7f0000000200)=0x5, 0x4) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000001980)={0x0, 0x0, &(0x7f0000001940)={&(0x7f00000018c0)=@ipv6_getroute={0x2c, 0x1a, 0x1, 0x0, 0x0, {}, [@RTA_UID={0x8}, @RTA_MARK={0x8}]}, 0x2c}}, 0x0) write$binfmt_misc(r6, &(0x7f0000000300), 0x6) getsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f00000000c0)={{{@in6=@mcast2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in6=@remote}, 0x0, @in=@empty}}, &(0x7f00000001c0)=0xe8) ioctl$sock_inet6_SIOCDELRT(r5, 0x890c, &(0x7f0000000300)={@mcast1, @empty, @private1, 0xfffffffd, 0x10, 0x4455, 0x500, 0x4, 0x100, r8}) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x200042, &(0x7f0000000200)={'trans=fd,', {'rfdno', 0x3d, r3}, 0x2c, {'wfdno', 0x3d, r3}, 0x2c, {[{@uname={'uname', 0x3d, '/dev/nullb0\x00'}}], [{@dont_measure}, {@dont_hash}, {@euid_eq={'euid', 0x3d, r9}}, {@seclabel}]}}) executing program 46: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$SIOCSIFMTU(r0, 0x8922, &(0x7f0000000b40)={'dummy0\x00'}) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x40, &(0x7f0000000840)=ANY=[@ANYBLOB="78226e6f65786163638173733d616e792c63616368653d66736361636865"]) (async) chdir(&(0x7f0000000100)='./file0\x00') (async) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x2) getsockopt$ax25_int(r2, 0x101, 0x9, &(0x7f00000001c0), &(0x7f0000000000)=0x4) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='pids.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x4000) (async) write$vhost_msg_v2(r3, &(0x7f00000003c0)={0x2, 0x0, {0x0, 0x0, 0x0, 0x2, 0x3}}, 0x48) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)) r4 = dup(r1) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) (async) syz_io_uring_setup(0x23a, &(0x7f00000002c0)={0x0, 0x4535, 0x10100, 0x7, 0x0, 0x0, r4}, &(0x7f0000000080), &(0x7f0000000480)) (async) getsockopt$inet_sctp_SCTP_GET_ASSOC_NUMBER(r4, 0x84, 0x1c, &(0x7f00000000c0), &(0x7f0000000140)=0x4) executing program 47: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_IO(r1, 0x2285, &(0x7f0000000140)={0x53, 0xfffffffffffffffb, 0x0, 0x1, @scatter={0x0, 0x0, 0x0}, 0x0, 0x0, 0x22000003, 0x10011, 0x1, 0x0}) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000180)={'lo\x00', {0x2, 0x4e21, @empty=0x7f000000}}) executing program 48: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) r2 = socket(0x2, 0x80805, 0x0) sendmmsg$inet(r2, &(0x7f0000000c80)=[{{&(0x7f0000000040)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000440)=[{&(0x7f0000000180)="fd", 0x1}], 0x1}}], 0x1, 0x0) r3 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r3, 0x84, 0xc, &(0x7f0000000240)=@assoc_value={0x0}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f00000002c0)={r4, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r1, 0x84, 0x9, &(0x7f0000000140)={r4, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x0, 0x3f8, 0x0, 0x32, 0x4}, 0x9c) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newnexthop={0x38, 0x68, 0x1, 0x100003, 0x80000000, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_UNBALANCED_TIMER={0x8, 0x3, 0x3}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x20048080}, 0x0) bind$inet6(r1, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r1, &(0x7f0000847fff)='X', 0xfee4, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r1, &(0x7f0000004900)=[{{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f00000004c0)="cc", 0x1}, {&(0x7f0000000ac0)="4e9dd319954453cfb964069ecd1e9e57f63f624a199c52d0c71dee297e3cc62907abd41ca061e83e7700876b8f6e5101c3cfc57a91e526f1114f3a24deb15bdc1ae3a4997defba7e8f54671921ca19354ecf9ef4ac40241e6b64006b1384c61f16bf71c22442de77e258c3b4e207d23cc92e7e3dc2263f662c1ff3cb3a0c3c8bb55725268a5c2ab5e56a8c4dcabf68f9752d4e403cefc66d46b3102415fdd39b1b6986be0f8fbc84414f5bf88aa16e962fdbd7bfd639bad83a507096a6e33fa26c296e2a", 0xc4}, {&(0x7f00000009c0)="cbc0d4c6d51135e674dba57d6ed2ddc12056125b0ee224059bbf1f648d3fa32b8c0565f8cf4476f3709c4ed60544b2430349014358210c255a7d8096eb553abab27c0ac83dc82625d4fdb15e93956483c4", 0x51}, {&(0x7f0000000240)="dabd58f0f476e1ee724050b11a34fb50bd7acdf8986a1bae5a6171a631e4ee6ce1fceaf3265694fa6c47559712e4683ebe7eb22cafe9b4e7d4fd9aedc49b9270e7a28fc6c70ca89b44cf10d87455a1c34c9c3671d9cf3a62d0fa1c14e41337b865365d05cab609e6359cadf7f8cb428422e18608aa775f8672b75e064b7634da1e740901cb364157a07b5a46bd94e80e75fd8b4bf6d1f5ea80156c990474115f68c565c5dcd8247d071dea9036be90096250304c76b78f01", 0xb8}, {&(0x7f0000000a40)="aca011498c4ac0b7f827ead24cbde30a1c401d69bbf00e0d63a3490cc9754869c64486b720e5def9cb9affdde4ced0fe0776226ed8745b35977d4fcf442f291dd74e3467a653acd1cfb4efd432d01d610486781db3dcc332f9b252a5507c386aa6", 0x61}, {&(0x7f0000000000)="a8881b4a98f50a234d9d8fbb5ed492ca94dded781eb4c44e84862c0aa48b0f06a53d4f74db01e8b7c8da032a1915704ce1c077b7b2a1c7e22786b38e44189f4e85b3f1073198a6ce8162d89cdce40891c4d362cc5ca5fbb8e660700a538d015988b6815b9d46ccda9e368c1fbc8a389adc0f421f38468a163ba8765e832115f61b042405278bdfba3a79cfda3c8453d2b483b9f872a3492e69e81a", 0x9b}, {&(0x7f00000008c0)="2e8dd0eee2a97f0dd0cbd80505ee0793e2b0aa874c8ffa76d69cbb088bd641c792047e589bd703a6befa1b46e1f895a6255b1d349a431005a1ef67cb6e1e7f5371b51ef8728c5a23f9d7346aa54ca30ffa29712f6463eefd1f2e2e0134c8a1ffca3ea413bb66c82ecbb114b125acf0144df3164d2653d5b616c3c97cc53453fe4cdcf954774147fed45ccbe9592c18848c7e454efed4eb32aaead3731cc9b0086a82133c6b7a4823d9ae42917f192cf0613c4194e4a1d5e3fd3eef855441d7298283f0b175b9af48a846944aa5f2dca16e5236a89f1c1306945bc4b895420b6bc64691cc86566f064f79cc", 0xeb}, {&(0x7f0000000440)="47b3be7a75f09a20302a26df27d2efe74c6c022a3dbe537ab15d7cca1666e8397decf681f573dfe4399c8a797453a8350817fea1b2adc9963a0a07e373fad1322102d75deb3bb93403a49fea1c5463fa1ced34db2bbf4a", 0x57}, {&(0x7f0000001080)="1fc09a390764166802fb41e3732a9f21408e5f97c1b811ed3f34f2dcab80f127ba1b74bf21ca369777b9faf02771a5b31ec9111c36b14c308ba794002caad7ab2361476fa0d269ca75210901fce82996dbd9a76cbd0085fbca35b49b5ee88cb23740f668fdebca91a7c153c170e0929c5de8c56f49e51f2e4700bcd34b355c18203a80ddfd60f478ff48c257c597c30c232924b05e5119acdcf61372a43bcfca60bce159dcd9077ba57b630d279859b236073a163de3b39e20fdc8428afde11d4ff26477b6ee9830d9a1c8aae982bb0c83f4f3adc685ddae903a9e4023f63f4f3bac3ff366a950b997116160ce22558ad42e43580512438c9e11e6f6b8ac6407407d9c39aa609d8c267a907228a5ca6111b405f09bdcafbc3bfb7e52c2633fd20e969348ef08117259acc953652a7a988a461a5629906c1a36482b5f2d784fd926c50c83f92117950a8551da6cc69351dd7d117719253dd2c041686e99577a92894456377f0c0458afaa0275206b4678abbbe6bd852392a24360f1adbd742b0d712d9318a9d93b2d5ef49e5de7cd5f0d35ccaf9676725fba524086131108d168a1952d626a5ef80bfc0b340262faa8d6fcec328d690266a84557a155943dc893813984909ac41adf60e8fdb7fe7645c9d7f6d5e14d603bd12dc90e5d752b7fb2c9990b2bc123729f293752509f575e4577c068f446c11fc53fb25c9f97076a5121618f72b04cc5020714028017e9d68be767508c21f7cc9fb76439e4edd903472b271bed2a19c9a53d306f5d36fc00ca4b82e93b7ef81f0f140c5993e9a035817bfe41ec894b9244772284e493311cefc4431a6f7e160e4c7035459c554bc5b31177b618db308d3fce0124db993979ba20e9db17f090fa438ca187adf5129301931f7a0787bcba095b3d50181f62284ad68349c9c9f50ac7d5f3f5cb08be78826f7c3c5068df3cd4db5c4283fb3b9ead414801ea63f059c340b0a693eaeeaddf17f3542f7933930e6a9918123526d9267b46a9cd76baf361df1cbc49ed5b8f650457d4d24142d83b1aef21d4f43837a2dced49697cdbcf4e963caaf68b6f22be01591a45ce4e3cc541a2c08338f0baa1585b78cd5564ebe500cf578c7ef806267d4bde067bba28a5417f0f2366a9e5873b1ed5e27307c75ae0dc719254764c3c778b7650e5cfb1b721766d28b53e2b09b0bf5747fecdd731555e183c91", 0x35d}], 0x9}}, {{0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000500)="bda033176eb146b36ef41f221a4e7ce48b2598d750606488520915c6806affc0a913781c7211ce1fcd59a12b5d5afdaf9d723f092ce9d1eed16e208f2e79831ca049e8979ad94621175c2c48c10e33b29f2def51498743b057efc21efe4be4e5f02e9d236f27190c29c5da0f3799452f5e3640340502fde4ae8c56b303e1b79b3d1842bf6277771bef544c745e7a80c9e7efdd1c619f69b9d01839aa326776d335689e4db7cb7e32fad8f4c40e943b43eb4ea173d720bf5998149625a731643636c8ddbe61e1d7d4736f8414a84acc40557012c82697d8a59c873424aefb3c7ff0dba302efaaf887a477b1ab7ea6c1def9db3514e444c1ef36c6cf42cde90d4bbb2e9a3a5d16a1bb191ad91cab867cd55037d507a12803f3df1b81f1857fad085dbc5c46aac14230d7a4f8b36d6bc63b4a16cd309b7697b421a662b83001b5ce5ab3ff80800243107df7aa6cae9a5db6a8f2a53ef7d6c6aeac76b83a15466c74a9cdbcde8505e3d14c0c3a47a36bf464168202dc88e25f4c1da57faf0eaa7ff16bdd751c2ae5778e169c8ffba57c9a20e24ad51e6e8e02b721e8ca94f131cc98e03b34b615a1db4080362de4ef215d5a0541aeb0c742a2636ac5af8538ceb3585ef9dca8037df55baa072096073b005b53eff0b899de59bc2b5d687d109520571eeacb30124c4012fe6cb9e3bf451be3d219206ddc35099101533cff5aee6c4783e00e6dd391f664052a6c66c62f62a49fde8fbe336543bf99b55e53b801e54c1d0a292da83db26a8a870ac1d8751c4bc0d495277295cd3a17f9e9a25d70214a17b981b62d5c75356ed025df3557a8b59648edd9d1dbdf169d91f9d85cfac11a57db0a14d33e8934a2cc98d389912a0d9942a40c3ee98d35da61d3bab1a32c9d788e9f74ee57012ca5bfd0dc090b591c64aae6a205fbd349fc372bbd7429983a69cae26ff8b5b019144d318ba225e46bc6cf8d7d3e5952333042542b2fd4fb4d88a3651dd8e14ecc2845d4e71f7dfd128e9e2ee2ab0062a3e701bb2477bfd73d7396ae522f11fa481078d1c7f7905e0846fb072dcf7c06102b3816ec4a3518514c7166d7385b680469f5184a93953258952554e68d93ea8f789c4f13982b65996d7d9cf19f0b39b72e1dc9079d84413bbc30d24fc481e24ef1beac020000000000000084d16a1c71b2c8a568481f4f1b254ccd66fbef4cacfc3e13f2c943a264e429824bef7297f93076aea55ed9cf12512c14ac3df331695024bd1e53369a87caf6894fce81594b43cb3dee05ab21", 0x38f}, {&(0x7f0000000300)="d8fe61cb28d9640d540c44cf98f32ab0975835e26ef8b3d434cb3d6fe6191cf7cb16c54970bbd8ce2b339ed8ca4fea5342c2bdc0f51e90ab1f8e28a1d04977ef48b42de3bbdfa152333d297fbeec0cbb4cf252eb909a27a5d47c0e37822213b2ea5789c033a030fda0d90c1f0dbddf59744cb991868d839bf7d800421e54", 0x7e}], 0x2}}], 0x2, 0x4048884) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000180)=0x10) r6 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r6, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r0, 0x84, 0xa, &(0x7f0000000140)={0x7, 0x4400, 0x2, 0x0, 0xa55, 0x3, 0xfff, 0x1, r7}, 0x20) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x8) executing program 7: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) getsockopt$llc_int(r2, 0x10c, 0x2, &(0x7f0000000740), &(0x7f0000000780)=0x4) r3 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x2) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) getsockopt$inet6_tcp_buf(r5, 0x6, 0xd, 0x0, 0x0) setsockopt$inet6_tcp_TLS_TX(r5, 0x6, 0x1, &(0x7f0000000240)=@gcm_128={{}, "ecb9d06d2d6e459d", "9ab7e8da5fbd3fc91d33e32cd9f5bddb", "6973ca9e", "e80ebfa5ac114dfa"}, 0x28) setsockopt$inet6_tcp_int(r5, 0x6, 0x3, &(0x7f0000000000), 0x4) ioctl$KVM_SET_VCPU_EVENTS(r4, 0x4040aea0, &(0x7f0000000000)=@arm64={0x3, 0x9, 0x4, '\x00', 0x16}) syz_emit_ethernet(0x32, &(0x7f0000000040)={@broadcast, @dev, @val={@val={0x88a8, 0x7, 0x0, 0x2}, {0x8100, 0x4, 0x0, 0x2}}, {@arp={0x806, @ether_ipv4={0x1, 0x800, 0x6, 0x4, 0x1, @local, @empty, @empty, @local}}}}, 0x0) ioctl$KVM_SET_GUEST_DEBUG(r4, 0x4048ae9b, &(0x7f0000000080)={0x1e0003, 0x0, [0x81, 0x6, 0x102, 0x3e00000000000000, 0x3d9ae88f, 0xc, 0x4000000000009, 0xa]}) ioctl$HCIINQUIRY(r0, 0x89a0, &(0x7f0000000000)={0x1, 0x200, '\x00\b\x00', 0x0, 0x3}) ioctl$KVM_SET_CPUID(r4, 0x4008ae8a, &(0x7f0000000140)={0x4, 0x0, [{0xc0000000, 0x3, 0x2, 0x3ff, 0x8}, {0xc0000000, 0x7, 0xd, 0x2, 0x844}, {0xdc45285117920ed8, 0x8, 0x2, 0xf, 0x8}, {0x0, 0x9, 0x7ff, 0x100, 0x2}]}) executing program 7: socket$kcm(0x2, 0xa, 0x2) socket$kcm(0x21, 0x2, 0x2) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) syz_init_net_socket$bt_bnep(0x1f, 0x3, 0x4) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x452c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0xffffdd86}}}}}}}, 0xfdef) executing program 8: setreuid(0xee00, 0x0) (async) r0 = socket(0x1, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000240)=@ethtool_ringparam={0x33, 0xfffffffe, 0x2f, 0x6, 0x40000, 0x4, 0x2, 0x81, 0xffffff19}}) r1 = getuid() (async) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) (async) r2 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000580)='.\x00', &(0x7f0000000040), 0x0, &(0x7f0000001c00)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r2, @ANYBLOB="2c00b30b8cc36e525ff5e733d5f0796c8df1184a0678e0e81238d48cb9c51916a38b867d704131808763cb19900324b6d04be147ebd3238af7d4babcec08b098970444f9549c8b343ba154d21a474a91440a08d4b8c739d34df223fece748babdfbbcea9fc2d"]) setreuid(0xee00, r1) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) (async) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_TIME_STAMP(r5, 0x0, 0x3, &(0x7f0000000000), 0x4) (async) ioctl$int_in(r4, 0x5452, &(0x7f0000000040)=0x8001) (async) r6 = socket$pppl2tp(0x18, 0x1, 0x1) (async) r7 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r6, &(0x7f00000001c0)=@pppol2tpv3in6={0x18, 0x1, {0x0, r7, 0x1, 0x1, 0x0, 0x2, {0xa, 0x4e20, 0x400000, @remote, 0x100}}}, 0x3a) (async) r8 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="0100000000000000000008000000080009000200000008000b"], 0x24}}, 0x10) getpgid(0x0) r10 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r10, 0x84, 0x1c, &(0x7f0000000040), &(0x7f0000000080)=0x4) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) (async) recvmmsg$unix(r4, &(0x7f0000005400)=[{{0x0, 0x0, &(0x7f00000018c0)=[{&(0x7f00000008c0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/242, 0xf2}, {&(0x7f0000000180)=""/31, 0x1f}, {&(0x7f0000000500)=""/227, 0xe3}, {&(0x7f0000000280)=""/147, 0x93}, {&(0x7f0000000600)=""/4, 0x4}, {&(0x7f0000000640)=""/36, 0x24}, {&(0x7f0000000680)=""/105, 0x69}, {&(0x7f0000000700)=""/233, 0xe9}], 0x9, &(0x7f0000001980)=[@rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}], 0xe8}}, {{&(0x7f0000001a80)=@abs, 0x6e, &(0x7f0000002f40)=[{&(0x7f0000001b00)=""/247, 0xf7}, {&(0x7f00000057c0)=""/4096, 0x1000}, {&(0x7f0000000800)=""/47, 0x2f}, {&(0x7f0000002c00)=""/182, 0xb6}, {&(0x7f0000002cc0)=""/158, 0x9e}, {&(0x7f0000002d80)=""/209, 0xd1}, {&(0x7f0000002e80)=""/138, 0x8a}], 0x7, &(0x7f0000002fc0)=[@cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x38, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xf8}}, {{&(0x7f00000030c0)=@abs, 0x6e, &(0x7f0000003400), 0x0, &(0x7f0000003440)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}], 0x50}}, {{&(0x7f00000034c0)=@abs, 0x6e, &(0x7f0000003700)=[{&(0x7f0000003540)=""/95, 0x5f}, {&(0x7f00000035c0)=""/26, 0x1a}, {&(0x7f0000003600)=""/118, 0x76}, {&(0x7f0000003680)=""/111, 0x6f}], 0x4, &(0x7f0000003740)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x34, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x138}}, {{&(0x7f0000003880)=@abs, 0x6e, &(0x7f00000039c0)=[{&(0x7f0000003900)=""/135, 0x87}], 0x1, &(0x7f0000003a00)=[@cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0x138}}, {{&(0x7f0000003b40), 0x6e, &(0x7f0000004d80)=[{&(0x7f0000003bc0)=""/227, 0xe3}, {&(0x7f0000003cc0)=""/4096, 0x1000}, {&(0x7f0000004cc0)=""/161, 0xa1}], 0x3}}, {{&(0x7f0000004dc0)=@abs, 0x6e, &(0x7f0000004e80)=[{&(0x7f0000004e40)=""/49, 0x31}], 0x1, &(0x7f0000004ec0)}}, {{&(0x7f0000004f00)=@abs, 0x6e, &(0x7f0000005040)=[{&(0x7f0000004f80)=""/123, 0x7b}, {&(0x7f0000005000)=""/19, 0x13}], 0x2, &(0x7f0000005680)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x24, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @cred={{0x1c}}, @rights={{0x28, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x120}}, {{0x0, 0x0, &(0x7f00000053c0)=[{&(0x7f00000051c0)=""/145, 0x91}, {&(0x7f0000005280)=""/41, 0x29}, {&(0x7f00000052c0)=""/213, 0xd5}], 0x3}}], 0x9, 0x1, &(0x7f0000005640)={0x77359400}) (async) r12 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r12, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) (async) r13 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r13, 0x400448c8, &(0x7f0000000340)={r12, r12, 0x8, 0x1f, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz1\x00'}) (async) sendmsg$NFT_BATCH(r11, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a48000000060a0b040000000000000000020000061c0004801800018008000100666962000c00028008000240002000020900010073797a30000000000900020073797a32"], 0x70}}, 0x4000852) (async) sendmmsg$unix(r3, &(0x7f0000006c40)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="11", 0x1}], 0x1}}], 0x1, 0x40015) executing program 7: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003300)=ANY=[@ANYBLOB="3c1100003e00010329bd700000dcdf250300000028"], 0x113c}}, 0x8004) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003300)=ANY=[@ANYBLOB="3c1100003e00010329bd700000dcdf250300000028"], 0x113c}}, 0x8004) (async) executing program 8: r0 = syz_open_dev$dmmidi(&(0x7f0000000080), 0x2, 0x2003) ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(r0, 0xc0245720, &(0x7f0000000000)={0x1}) io_uring_setup(0x6286, &(0x7f0000000080)) r1 = syz_io_uring_setup(0x238, &(0x7f0000000080)={0x0, 0x40, 0x10, 0x2, 0x2c5}, 0x0, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0x810c5701, &(0x7f0000000480)) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0x810c5701, &(0x7f0000000100)) r2 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r2, &(0x7f0000000080)=@name={0x1e, 0x2, 0xfffffffffffffffd, {{0x42}, 0x1}}, 0x10) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x4) ioctl$TIOCCONS(r3, 0x541d) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) ioctl$VFAT_IOCTL_READDIR_BOTH(r1, 0x82307201, &(0x7f0000000240)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) executing program 8: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x103000, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x2000) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_CLIENT(r1, 0xc04c5349, &(0x7f00000000c0)={0x2, 0x6, 0x5}) mkdir(&(0x7f00000003c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f00000001c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2901090, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000900)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) mprotect(&(0x7f0000feb000/0x12000)=nil, 0x12000, 0x2000000) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r2, r3, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, &(0x7f00000005c0)="2636660f7fb82fbc00003e2666460fc7b200000000b9800000c00f3235000100000f303e2e660f38231e0f32c744240002000000c7442406000000000f011c24b9221001c0b800900000ba000000000f3066420f38814f682e650fc7720067440f017808f244d33d08000000", 0x6c}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) executing program 2: r0 = eventfd2(0xc, 0x80801) statx(r0, 0xfffffffffffffffd, 0x1000, 0x20, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000680)=@raw={'raw\x00', 0x8, 0x3, 0x460, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x390, 0xffffffff, 0xffffffff, 0x390, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [0xffffff00], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x290, 0x2c0, 0x0, {}, [@common=@srh1={{0x90}, {0x1, 0x10, 0x7, 0x9, 0x41d4, @remote, @dev={0xfe, 0x80, '\x00', 0x26}, @private1={0xfc, 0x1, '\x00', 0x1}, [0xffffff00, 0xff, 0xff], [0x0, 0xff000000, 0xff, 0xffffff00], [0x0, 0xff000000, 0xff000000, 0xffffffff], 0x213, 0x20}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x4c0) executing program 2: r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f0000000100)={0x0, @in6={{0xa, 0x0, 0x0, @dev}}}, &(0x7f0000000000)=0x100) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000280)={0x3}, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000000ae00)={0x24, 0x12, 0xa01, 0x0, 0x0, {0x80}, [@nested={0xe, 0xa4, 0x0, 0x1, [@generic="9f1a19c663957bba2228"]}]}, 0x24}}, 0x20) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=@base={0x9, 0x4, 0x4, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x2, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r3}, 0x38) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x6, r3}, 0x38) r4 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_mreqsrc(r4, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x8) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r5, 0x4008af60, &(0x7f0000000400)={@my=0x0}) r6 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r6, &(0x7f0000000080)={0x28, 0x0, 0x0, @my=0x0}, 0x10) r7 = syz_open_procfs(0x0, &(0x7f0000000040)='fdinfo/3\x00') ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x0, r7, 0x0, 0x0}) executing program 2: socket$kcm(0x2, 0xa, 0x2) socket$kcm(0x21, 0x2, 0x2) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {0x0}, {&(0x7f0000001480)}], 0x3) ioctl$FS_IOC_GETFSMAP(0xffffffffffffffff, 0x40305839, &(0x7f0000000000)=ANY=[@ANYBLOB="00000000000800000000000000000000000000000002"]) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$sock_timeval(r2, 0x1, 0x2, 0x0, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, &(0x7f0000000000)=""/152, &(0x7f00000000c0)=0x98) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val, @void, @eth={@broadcast, @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x452c, 0x0, 0x0, 0x0, 0x2f, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x0, 0x6558, 0x18, 0x0, @wg=@data={0x4, 0x0, 0xffffdd86}}}}}}}, 0xfdef) executing program 0: r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000440), 0xe082, 0x0) ioctl$SOUND_MIXER_READ_STEREODEVS(r0, 0x80044dfb, 0xfffffffffffffffd) executing program 0: r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000002340)=0x4) ioctl$FIONREAD(r0, 0x541b, &(0x7f0000000040)) executing program 0: syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f0000000380)={[{@mpol={'mpol', 0x3d, {'interleave', '=static', @void}}}]}) umount2(&(0x7f0000000000)='./cgroup\x00', 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x2, 0x2172, 0xffffffffffffffff, 0xb6506000) mremap(&(0x7f0000005000/0x2000)=nil, 0x2000, 0x2000, 0x7, &(0x7f0000ffb000/0x2000)=nil) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newchain={0x24, 0x64, 0x200, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x6, 0xfff2}, {0xfff1, 0x5}, {0xa, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x804}, 0x0) r1 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000080), 0x802, 0x0) write$UHID_CREATE(r1, &(0x7f0000000b00)={0x0, {'syz1\x00', 'syz0\x00', 'syz0\x00', &(0x7f0000000040)=""/15, 0xf, 0xa0, 0x8, 0x3, 0x5, 0x1635}}, 0x120) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x2000) write$UHID_INPUT(r1, &(0x7f00000030c0)={0xc, {"a2e3ad21ed0d52f91b5d390887f70e06d038e7ff7fc6e5539b3272298b089b07081b4d090890e0878f0e1ac6e7049b3366959bfc9a240d2567f3988f7ef319520100ffe8d178708c523c921b1b9b39070d075d0936cd3b78130d9b61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c9000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdc80c47ee4f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78ff95b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af0000807e0000000002d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b4051db55e0510a6e4114a53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a6d8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00000000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251a4523a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d664130bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2381f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) munmap(&(0x7f0000004000/0x3000)=nil, 0x3000) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r5, @ANYBLOB="0c000280060001"], 0x24}}, 0x0) r6 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000140)) sendmsg$BATADV_CMD_GET_DAT_CACHE(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="7b040008a5b1beb1f128ad01dbc6a70497ffcef43830ff1bcf6981a85a1bfbff000000b31e77a24ef2bff8fcc14918c8a5ebca06896539ba530b509450e9", @ANYRES16=r6, @ANYBLOB="0303000000000000000006000000"], 0x14}}, 0x2000c0c0) setsockopt$inet6_int(r0, 0x29, 0x4b, &(0x7f0000000100)=0x4, 0x4) socket$inet_udp(0x2, 0x2, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000100)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha512\x00'}, 0x58) r8 = accept4(r7, 0x0, 0x0, 0x0) close_range(r8, 0xffffffffffffffff, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e20, 0x40, @ipv4={'\x00', '\xff\xff', @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x5}, 0x1c) r9 = userfaultfd(0x3) ioctl$UFFDIO_API(r9, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x8}) socket$nl_route(0x10, 0x3, 0x0) executing program 8: r0 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$sock_ifreq(r0, 0x8990, &(0x7f0000000180)={'bond0\x00', @ifru_names='wlan0\x00'}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r2 = syz_open_dev$vbi(&(0x7f0000000000), 0x1, 0x2) ioctl$VIDIOC_CREATE_BUFS(r2, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x9, 0x0, 0x4, 0x30314142, [], [0x8200], 0x247}}}) (async) ioctl$VIDIOC_CREATE_BUFS(r2, 0xc100565c, &(0x7f00000013c0)={0x0, 0x2, 0x2, {0x5, @vbi={0x9, 0x0, 0x4, 0x30314142, [], [0x8200], 0x247}}}) ioctl$VIDIOC_QBUF(r2, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "8000"}, 0x0, 0x2, {}, 0x20800}) (async) ioctl$VIDIOC_QBUF(r2, 0xc058565d, &(0x7f0000000200)=@fd={0x0, 0x5, 0x4, 0x0, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "8000"}, 0x0, 0x2, {}, 0x20800}) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a310000000014000780050015000c0000000800084000000090050005000a000000050001000600000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x70bd2a, 0x25dfdbfb, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7}, [@FRA_GENERIC_POLICY=@FRA_DPORT_RANGE={0x8, 0x18, {0x4e21, 0x4e24}}]}, 0x24}, 0x1, 0x0, 0x0, 0x4048095}, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="24000000200001032abd7000ffdbdf250a"], 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x4000) socket(0x10, 0x803, 0x0) (async) r4 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) (async) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) ioctl$SIOCX25SFACILITIES(r2, 0x89e3, &(0x7f00000001c0)={0x44, 0x200, 0xb, 0xa, 0xe, 0x40}) getsockname$packet(r4, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r5, @ANYBLOB="01980000000000002000128008000100677265001400028008000100", @ANYRES32=r5], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) socket(0x10, 0x3, 0x0) (async) r7 = socket(0x10, 0x3, 0x0) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) (async) sendmsg$nl_route_sched(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000006c0)=@newtfilter={0x47c, 0x28, 0xd27, 0x1004001, 0x0, {0x0, 0x0, 0x0, r8, {0x9, 0x9}, {0x0, 0x9}, {0xd, 0xe}}, [@filter_kind_options=@f_cgroup={{0xb}, {0x44c, 0x2, [@TCA_CGROUP_EMATCHES={0xc, 0x3, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x9}}]}, @TCA_CGROUP_ACT={0x34, 0x1, [@m_skbedit={0x30, 0x11, 0x0, 0x0, {{0xc}, {0x4}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x2, 0x1}}}}]}, @TCA_CGROUP_POLICE={0x408, 0x2, [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x8000, 0xa1a, 0x2, 0x8001, 0xfffff800, 0xffffffff, 0x6, 0x7, 0x4861, 0x831, 0x9, 0x3, 0x6, 0x6, 0x4, 0x8, 0xf, 0x8, 0x4, 0x2, 0x9, 0x0, 0x0, 0x3, 0x2, 0x7, 0x5, 0x7, 0x3ff, 0xe65d, 0x6, 0x1000, 0x401, 0x5, 0x6, 0x6, 0x9, 0x0, 0x7fff, 0x2b, 0x1, 0x7, 0x2, 0x7, 0x1, 0x7, 0x8, 0x80000001, 0x5, 0x5f2cc059, 0x9, 0x6, 0x7, 0x7, 0x3ff, 0x4a65, 0x40, 0xfffffffc, 0x5, 0x9469, 0x4, 0x1, 0x0, 0x68c, 0x3, 0x1ae7, 0xe48, 0x2, 0x2, 0x4, 0xfffffffc, 0x7, 0xf5, 0x98d, 0xffff, 0xc0, 0x1, 0x2, 0x8, 0x1, 0xb9c, 0x9, 0x7fffffff, 0x5dc4, 0x2, 0x100000, 0x68e, 0xc, 0x0, 0x994f, 0x4, 0x0, 0xfff, 0x8c8, 0x401, 0x3, 0x1, 0x2, 0x7, 0x80000001, 0x0, 0x9, 0x7f, 0x6, 0xeb6a, 0x7fff, 0x2, 0x976, 0x3, 0x7f, 0x9, 0x65d, 0x7, 0x5, 0x7, 0xc, 0xfa, 0x0, 0x1, 0x7, 0x3, 0x2, 0x0, 0xf, 0xe, 0xfffffff9, 0x0, 0x400, 0xf5, 0xa, 0xfffffffe, 0xfffffffb, 0xd, 0x9, 0xff, 0x3, 0x5dce04bf, 0x9, 0x4, 0x5, 0xd, 0x8, 0x7, 0xfffffff8, 0x0, 0x2, 0x10, 0x0, 0x1, 0x28, 0x3, 0x80000000, 0x4784, 0x7, 0x7, 0x4, 0x5, 0x6, 0x7, 0x9, 0x1714, 0x5, 0x4, 0x7, 0x1, 0xffffffff, 0xeaec4000, 0x7cf, 0x5, 0x100, 0x5, 0x0, 0x1, 0x0, 0xaec, 0x3596, 0xfffff511, 0xffffffff, 0x0, 0x3, 0x1, 0x1, 0x7, 0xb3, 0x80000001, 0x0, 0x5, 0x7, 0x6, 0x6, 0x2871, 0x0, 0x80000000, 0x8001, 0x5, 0x4, 0x2, 0x6, 0x8, 0x0, 0x3, 0x1, 0x981, 0xfff, 0xc, 0x4, 0x401, 0x4, 0x8, 0xbb1, 0x1, 0x0, 0xc, 0x40, 0x80000000, 0x6, 0xbe, 0x0, 0x9, 0x10000, 0x6, 0x33, 0x4, 0x3ff, 0x5c, 0x2, 0x1ff, 0x533, 0x2, 0x3, 0x5, 0x100, 0x7, 0x0, 0x3, 0xfffffffb, 0x6, 0x6, 0x2, 0x2, 0x1, 0x6, 0x416, 0xfc, 0x10001, 0x0, 0x80000000, 0x6, 0x9, 0xffffffc7, 0x9, 0x9816, 0x1, 0x4, 0x101, 0x6]}]}]}}]}, 0x47c}, 0x1, 0x0, 0x0, 0x810}, 0x48c0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) executing program 7: r0 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x0) ioctl$I2C_SMBUS(r0, 0x720, &(0x7f0000000140)={0x0, 0x0, 0x1, 0x0}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000001c0)=ANY=[@ANYBLOB="48010000", @ANYRES16=r2, @ANYBLOB="01000000000000000000010000000400048008000200010000000800010000000000080108805400078008000500000000000800050000000000080005000000000008000500000000000800050000000000080005000000000008000500000000000800050000000000080005008918bf1808000500000000002c0007800800050000000000080006000000000008000602000000000800050000000000080006000a0000004400078008008500000000000800050000000000080005003eb2c64908000600000000000800050000000000080006000000000008000600000000000800050000000000040007"], 0x148}}, 0x0) executing program 7: bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x11, 0x8, &(0x7f0000000300)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1089d8b8588d72ec29c48284b70043dc6124d877142a48448b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d4023f210fa34b63a715a74e802a0dc6bf25"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000480)=@mangle={'mangle\x00', 0x44, 0x6, 0x3a8, 0x2b0, 0x2b0, 0x2b0, 0x138, 0x98, 0x380, 0x380, 0x380, 0x380, 0x380, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x0, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x6}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0x70, 0x98}, @ECN={0x28}}, {{@ip={@loopback, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@broadcast, @empty, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x408) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f0000000180)="66c74424001967753ec744240200900000c7442406000000000f0114248fc97c818c121a50fca996317c66baa100ec7ca767dd87eb00eae5f50000bf00c4e169751b0f01f135000020000f22e0", 0x4d}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000980)=[@text32={0x20, 0x0}], 0x1, 0x51, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x7, 0xf, 0x9, '\x00', 0x5}) ioctl$KVM_RUN(r2, 0xae80, 0x0) executing program 8: r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000700), 0x2, 0x0) r1 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x8, 0x3, 0x540, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x470, 0xffffffff, 0xffffffff, 0x470, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [0x0, 0x0, 0x0, 0xff000000], 'veth0_macvtap\x00', 'pimreg0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [0x0, 0x0, 0x0, 0xffffffff], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x3a0, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x3a, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x7}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@remote, 'virt_wifi0\x00', {0x3ff}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x5a0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000001c0)={0x0, 0x20, &(0x7f0000000080)=[@in={0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, @in={0x2, 0x4e22, @remote}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f00000000c0)={r3, @in={{0x2, 0x4e23, @empty}}, 0x0, 0x2, 0x0, 0x0, 0xa17433da3c5d69a5, 0x2, 0x81}, 0x9c) getsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='fd/4\x00') ioctl$FICLONERANGE(r0, 0x4020940d, &(0x7f0000000140)={{r5}, 0x5, 0x2, 0x7}) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000003c0)={0xffffffffffffffff, 0xffffffffffffffff}) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000280)={0x1, &(0x7f0000000180)=[{0x6, 0x0, 0x0, 0x7fc00101}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r9, 0xc0502100, 0x0) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f00000004c0)={r3, 0x2, 0x401}, &(0x7f0000000500)=0x8) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x1f, &(0x7f0000000540)={r10, @in6={{0xa, 0x4e22, 0x86b, @dev={0xfe, 0x80, '\x00', 0x2b}, 0xf4}}, 0x0, 0x4}, &(0x7f0000000600)=0x90) ppoll(&(0x7f00000006c0)=[{0xffffffffffffffff, 0x202c}, {r2, 0x101}, {0xffffffffffffffff, 0x420}, {0xffffffffffffffff, 0x1264}], 0x4, 0x0, 0x0, 0x0) sendmsg$unix(r7, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000480)="03", 0x1}], 0x1, &(0x7f0000000640)=ANY=[@ANYBLOB="70b53c9cd314d8182959f0c18c71ae744cd4b6aacc33722976ffecff1653ee9bb54272009900f2d89c8a2f8cbe7597f619a002088e4e2aefa74ec3b73f09f437dbed6b51aa13efe2901e3c53", @ANYRES16=r8], 0x18, 0x400c000}, 0x0) setsockopt$sock_int(r8, 0x1, 0x2a, &(0x7f0000000000), 0x4) recvmmsg(r8, &(0x7f0000000940)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r6) ioctl$sock_SIOCGIFINDEX_802154(r11, 0x8933, &(0x7f0000000340)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000400)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r12, @ANYBLOB="4d7e2bbd7000feffffff2a00000005003600800000000c00050000000000000000000600060002000000050037000100000008000200", @ANYRES32=r13, @ANYBLOB="5ea90a02cab952b6e6ecc6e32ec7d200"], 0x40}, 0x4, 0x700000000000000, 0x0, 0x8081}, 0x84) sendmsg$IEEE802154_LLSEC_DEL_KEY(r6, &(0x7f0000000300)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x64, r12, 0x100, 0x70bd2b, 0x25dfdbfe, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0002}}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan3\x00'}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xffff}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xaaaaaaaaaaaa0202}}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x8}, @IEEE802154_ATTR_LLSEC_KEY_SOURCE_SHORT={0x8, 0x2c, 0x804}, @IEEE802154_ATTR_LLSEC_KEY_ID={0x5, 0x2e, 0x5}]}, 0x64}, 0x1, 0x0, 0x0, 0x8000}, 0x4008005) prctl$PR_SET_UNALIGN(0x6, 0x1) r14 = getpgrp(0xffffffffffffffff) syz_open_procfs$namespace(r14, &(0x7f0000000080)='ns/pid_for_children\x00') executing program 0: mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xb0a54e68b1cd2fdb, 0x103) timer_create(0x0, &(0x7f00000004c0)={0x0, 0x5, 0x1, @thr={0x0, 0x0}}, &(0x7f0000000500)=0x0) timer_settime(r0, 0x1, &(0x7f0000000540)={{0x77359400}}, &(0x7f0000000580)) pipe2$9p(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x880) write$P9_RVERSION(r1, &(0x7f0000000300)=ANY=[@ANYBLOB="1500000065fffff53000000800395032303030"], 0xfffffffffffffd9f) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r3, &(0x7f0000000300)=ANY=[], 0x15) r4 = dup(r3) write$P9_RLERRORu(r4, &(0x7f0000000540)=ANY=[@ANYBLOB="8b"], 0x53) write$RDMA_USER_CM_CMD_SET_OPTION(r4, &(0x7f0000000100)={0xe, 0x18, 0xfa00, @id_afonly={0x0}}, 0x20) write$binfmt_elf64(r4, &(0x7f0000000340)=ANY=[@ANYBLOB="7f454c4600073f034b0b00000000000003003e00ffffffe935"], 0x7c8) mount$9p_fd(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r2, @ANYBLOB=',wfdno=', @ANYRESHEX=r4]) executing program 8: madvise(&(0x7f0000122000/0x4000)=nil, 0x4000, 0x66) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv6_newrule={0x38, 0x18, 0x1, 0x0, 0x0, {0xa, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}, @FRA_SRC={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @none}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000a40)={0x1f, 0xd, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x5}, 0xe) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001900)=ANY=[@ANYBLOB="2c0000041e00010000c3aeba8823bda665e80000", @ANYRES32=0x0, @ANYBLOB="000004000a0002000000000000000000"], 0x28}}, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af25, &(0x7f0000000940)) r4 = semget$private(0x0, 0x4, 0x1) semctl$IPC_INFO(r4, 0x0, 0x3, &(0x7f00000000c0)=""/229) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) executing program 2: r0 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) fchdir(r1) open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) mkdir(&(0x7f0000000000)='./control\x00', 0x0) r2 = openat$cgroup(r1, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_procs(r2, &(0x7f0000000080)='cgroup.threads\x00', 0x2, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="14000000", @ANYRES16=0x0, @ANYBLOB="31039abf54b35ba3000000001700"], 0x14}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) getsockopt$netrom_NETROM_T1(r1, 0x103, 0x1, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async) sendmsg$nl_generic(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[], 0x148}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB="01000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, &(0x7f0000000180)="cc2dc08a9b8de89ce8007527f71e7c4ecaeb6eb20a7274a028a2c871eb483e69e6d5a9ae416b", &(0x7f0000000280)=@buf="7b8daea8ba1d2c0ded2260b6369fd4f34b68c496c8a9a2601c5e097c2c8fde771bdb59c0f036cefd07ff25d26d7567a98f6ee81dc5c4f004325c5392f46fc881bdb44854a9fb56c2357f48f2561d49ba4443a319fc25b531ed01accceacc0c2d8aabfc9a123988c021d7e68699f5bbc7c46e5af266fc5121ba5cccb852b5e19e9dae7e1cbff9c3aa501492e7f427d8b8871ec2080f7eb3b2d174a489c0b3446138aa7b8f7442b5", 0x1}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000071"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r3}, 0x10) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)={0x50, r5, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random='n'}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "dba06c8914"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_DEFAULT={0x4}]}]}]}, 0x50}}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000020180)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r8, 0x0) write$rfkill(r8, &(0x7f0000000340)={0x7fff, 0x1, 0x2, 0x1, 0x1}, 0x8) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000500)={'filter\x00', 0x4, 0x4, 0x3e0, 0x0, 0x1f0, 0x1f0, 0x2f8, 0x2f8, 0x2f8, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0x108, 0x0, {0x3ed}}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x20c49a, 'syz0\x00'}}}, {{@arp={@rand_addr, @loopback, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@link_local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'gretap0\x00', 'bridge_slave_0\x00'}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x0, 0x6}}}, {{@arp={@remote, @broadcast, 0x0, 0x0, 0x0, 0x0, {}, {@mac}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_bridge\x00', 'lo\x00'}, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x20c49a, 'syz0\x00'}}}], {{'\x00', 0xc0, 0xe8}, {0x28, '\x00', 0x2}}}}, 0x430) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40800, 0x0) utime(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x2e85dc65, 0xd58}) r10 = syz_open_procfs$userns(0x0, &(0x7f0000000000)) r11 = shmget$private(0x0, 0x3000, 0x54001800, &(0x7f000010d000/0x3000)=nil) r12 = shmat(r11, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffdfff) shmdt(r12) preadv2(r2, &(0x7f0000001f00)=[{&(0x7f0000000940)=""/187, 0xbb}, {&(0x7f0000000a00)=""/4096, 0x1000}, {&(0x7f0000000400)=""/23, 0x17}, {&(0x7f0000001ac0)=""/146, 0x92}, {&(0x7f0000001b80)=""/242, 0xf2}, {&(0x7f0000001c80)=""/143, 0x8f}, {&(0x7f0000001d40)=""/248, 0xf8}, {&(0x7f0000001e40)=""/145, 0x91}, {&(0x7f0000001a00)=""/71, 0x47}], 0x9, 0x6, 0x5, 0x7) ioctl$NS_GET_OWNER_UID(r10, 0xb704, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r9, 0x400454da, &(0x7f0000000080)=r13) executing program 0: sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) syz_open_dev$sndmidi(0x0, 0x2, 0x141102) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='vegas\x00', 0x6) socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r0, &(0x7f0000001300)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_IPV6_DSTOPTS(r1, 0x29, 0x3b, &(0x7f0000000040)=ANY=[@ANYBLOB="8400001000000000"], 0x8) sendmmsg$inet6(r1, &(0x7f0000000a00)=[{{&(0x7f0000000240)={0xa, 0x4e20, 0xc52, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x4}, 0x1c, &(0x7f0000000200)=[{&(0x7f00000004c0)="f3", 0x1}], 0x1}}], 0x1, 0x4000841) listen(r1, 0x2000fff) accept(r1, 0xfffffffffffffffd, &(0x7f0000000180)) unshare(0x2a020400) syz_clone3(&(0x7f0000001240)={0xc0000, 0x0, 0x0, 0x0, {}, 0x0, 0x0, 0x0, 0x0}, 0x58) r2 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000000), 0x500, 0x0) mkdirat(r2, &(0x7f0000000040)='./file0\x00', 0x4) write$binfmt_script(r0, &(0x7f0000000200), 0xfffffd9d) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001000000140007000000000003"], 0x74}}, 0x0) executing program 7: r0 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x4, 0x70bd29, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x28080}, 0xe29bb9bfcb0d33fd) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r0, 0x800, 0x70bd28, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbfd, {}, ["", ""]}, 0x14}}, 0x1) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r1) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000400)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000440)={'wpan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000440)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(r1, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r2, 0xb00, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_PAN_ID={0x6, 0x9, 0xfffd}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) sendmsg$NL802154_CMD_SET_PAN_ID(r1, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r2, 0xb00, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_PAN_ID={0x6, 0x9, 0xfffd}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r2, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r2, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000680)='ns/uts\x00') (async) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000680)='ns/uts\x00') ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) (async) r6 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x48, r2, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r5}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x40440a0}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x1c, r2, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000000}, 0x24000091) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4090}, 0x240040c0) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a00), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, r7, 0x1a6eee6dfa759078, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40000) (async) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, r7, 0x1a6eee6dfa759078, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40000) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b40), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000b80)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r8, &(0x7f0000000c40)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r9, 0x200, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x22) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c80)={'wpan1\x00'}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r1, &(0x7f0000000d80)={&(0x7f0000000cc0), 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x20, r7, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c810}, 0x4c0d5) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000e00), r8) sendmsg$DEVLINK_CMD_TRAP_SET(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001040)={&(0x7f0000000e40)={0x1dc, r11, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x4001}, 0x4814) (async) sendmsg$DEVLINK_CMD_TRAP_SET(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001040)={&(0x7f0000000e40)={0x1dc, r11, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x4001}, 0x4814) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001100), r8) sendmsg$IPVS_CMD_GET_DEST(r12, &(0x7f00000012c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001280)={&(0x7f0000001140)={0x12c, r13, 0x2, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x38}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5f}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x37}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xa3a}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3a}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8000}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7fffffff}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x5d}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xa}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x21}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x15}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x18}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x73}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xec3}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x4040880}, 0x20000000) syz_genetlink_get_family_id$nl802154(&(0x7f0000001340), r1) (async) r14 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001340), r1) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000001400)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0xaa6a72ee28759772}, 0xc, &(0x7f00000013c0)={&(0x7f0000001380)={0x20, r14, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x80) executing program 49: madvise(&(0x7f0000122000/0x4000)=nil, 0x4000, 0x66) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000004380)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@ipv6_newrule={0x38, 0x18, 0x1, 0x0, 0x0, {0xa, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x5, 0x2}, [@FIB_RULE_POLICY=@FRA_GOTO={0x8, 0x1e, 0x1}, @FRA_SRC={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x20000000) connect$bt_l2cap(r0, &(0x7f0000000040)={0x1f, 0x0, @none}, 0xe) connect$bt_l2cap(r0, &(0x7f0000000a40)={0x1f, 0xd, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x5}, 0xe) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001900)=ANY=[@ANYBLOB="2c0000041e00010000c3aeba8823bda665e80000", @ANYRES32=0x0, @ANYBLOB="000004000a0002000000000000000000"], 0x28}}, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af25, &(0x7f0000000940)) r4 = semget$private(0x0, 0x4, 0x1) semctl$IPC_INFO(r4, 0x0, 0x3, &(0x7f00000000c0)=""/229) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) executing program 50: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000001a80)=ANY=[@ANYBLOB="01000000040000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000001c0)={r0, &(0x7f0000000180)="cc2dc08a9b8de89ce8007527f71e7c4ecaeb6eb20a7274a028a2c871eb483e69e6d5a9ae416b", &(0x7f0000000280)=@buf="7b8daea8ba1d2c0ded2260b6369fd4f34b68c496c8a9a2601c5e097c2c8fde771bdb59c0f036cefd07ff25d26d7567a98f6ee81dc5c4f004325c5392f46fc881bdb44854a9fb56c2357f48f2561d49ba4443a319fc25b531ed01accceacc0c2d8aabfc9a123988c021d7e68699f5bbc7c46e5af266fc5121ba5cccb852b5e19e9dae7e1cbff9c3aa501492e7f427d8b8871ec2080f7eb3b2d174a489c0b3446138aa7b8f7442b5", 0x1}, 0x20) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r1}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000071"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000500)='percpu_free_percpu\x00', r3}, 0x10) r4 = socket$inet_udplite(0x2, 0x2, 0x88) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f000000b500), 0xffffffffffffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)={0x50, r5, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0x5, 0x34, @random='n'}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "dba06c8914"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_DEFAULT={0x4}]}]}]}, 0x50}}, 0x800) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='cpuacct.usage_percpu\x00', 0x275a, 0x0) write$binfmt_script(r8, &(0x7f0000020180)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x0, 0x10012, r8, 0x0) write$rfkill(r8, &(0x7f0000000340)={0x7fff, 0x1, 0x2, 0x1, 0x1}, 0x8) setsockopt$ARPT_SO_SET_REPLACE(r4, 0x0, 0x60, &(0x7f0000000500)={'filter\x00', 0x4, 0x4, 0x3e0, 0x0, 0x1f0, 0x1f0, 0x2f8, 0x2f8, 0x2f8, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0x108, 0x0, {0x3ed}}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x20c49a, 'syz0\x00'}}}, {{@arp={@rand_addr, @loopback, 0x0, 0x0, 0x0, 0x0, {}, {@mac=@link_local}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'gretap0\x00', 'bridge_slave_0\x00'}, 0xc0, 0xe8}, @unspec=@NFQUEUE1={0x28, 'NFQUEUE\x00', 0x1, {0x0, 0x6}}}, {{@arp={@remote, @broadcast, 0x0, 0x0, 0x0, 0x0, {}, {@mac}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'veth0_to_bridge\x00', 'lo\x00'}, 0xc0, 0x108}, @unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x20c49a, 'syz0\x00'}}}], {{'\x00', 0xc0, 0xe8}, {0x28, '\x00', 0x2}}}}, 0x430) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40800, 0x0) utime(&(0x7f0000000380)='./file0\x00', &(0x7f00000003c0)={0x2e85dc65, 0xd58}) r10 = syz_open_procfs$userns(0x0, &(0x7f0000000000)) r11 = shmget$private(0x0, 0x3000, 0x54001800, &(0x7f000010d000/0x3000)=nil) r12 = shmat(r11, &(0x7f0000000000/0x4000)=nil, 0xffffffffffffdfff) shmdt(r12) preadv2(r2, &(0x7f0000001f00)=[{&(0x7f0000000940)=""/187, 0xbb}, {&(0x7f0000000a00)=""/4096, 0x1000}, {&(0x7f0000000400)=""/23, 0x17}, {&(0x7f0000001ac0)=""/146, 0x92}, {&(0x7f0000001b80)=""/242, 0xf2}, {&(0x7f0000001c80)=""/143, 0x8f}, {&(0x7f0000001d40)=""/248, 0xf8}, {&(0x7f0000001e40)=""/145, 0x91}, {&(0x7f0000001a00)=""/71, 0x47}], 0x9, 0x6, 0x5, 0x7) ioctl$NS_GET_OWNER_UID(r10, 0xb704, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r4, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', 0x0}) ioctl$TUNSETIFINDEX(r9, 0x400454da, &(0x7f0000000080)=r13) executing program 51: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[@ANYBLOB="740000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="2b030040000000004c0012800b00010067656e65766500003c0002800800050001000000140007000000000003"], 0x74}}, 0x0) executing program 52: r0 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r0, 0x4, 0x70bd29, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_DOI={0x8}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x1}, @NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}, @NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x3}]}, 0x4c}, 0x1, 0x0, 0x0, 0x28080}, 0xe29bb9bfcb0d33fd) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x1c, r0, 0x800, 0x70bd28, 0x25dfdbff, {}, [@NLBL_CALIPSO_A_DOI={0x8, 0x1, 0x2}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, 0x0, 0x4, 0x70bd27, 0x25dfdbfd, {}, ["", ""]}, 0x14}}, 0x1) syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r1) (async) r2 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r1) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000400)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000440)={'wpan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000440)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_SET_PAN_ID(r1, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r2, 0xb00, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_PAN_ID={0x6, 0x9, 0xfffd}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) (async) sendmsg$NL802154_CMD_SET_PAN_ID(r1, &(0x7f0000000500)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000480)={0x34, r2, 0xb00, 0x70bd29, 0x25dfdbfb, {}, [@NL802154_ATTR_PAN_ID={0x6, 0x9, 0xfffd}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_PAN_ID={0x6, 0x9, 0x3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r2, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) (async) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x24, r2, 0x200, 0x70bd28, 0x25dfdbfc, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x24}, 0x1, 0x0, 0x0, 0x40000}, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000680)='ns/uts\x00') (async) r5 = syz_open_procfs$namespace(0x0, &(0x7f0000000680)='ns/uts\x00') ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) (async) r6 = ioctl$NS_GET_PARENT(0xffffffffffffffff, 0xb702, 0x0) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000000780)={&(0x7f0000000640)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f0000000740)={&(0x7f00000006c0)={0x48, r2, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x200000002}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x1}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r5}, @NL802154_ATTR_NETNS_FD={0x8, 0x1d, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r3}, @NL802154_ATTR_WPAN_PHY={0x8, 0x1, 0x2}]}, 0x48}, 0x1, 0x0, 0x0, 0x40440a0}, 0x0) sendmsg$NL802154_CMD_GET_SEC_DEV(r1, &(0x7f0000000880)={&(0x7f00000007c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000840)={&(0x7f0000000800)={0x1c, r2, 0x4, 0x70bd2a, 0x25dfdbfd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x8000000}, 0x24000091) sendmsg$NLBL_CALIPSO_C_LISTALL(r1, &(0x7f0000000980)={&(0x7f00000008c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)={0x24, 0x0, 0x400, 0x70bd2a, 0x25dfdbfb, {}, [@NLBL_CALIPSO_A_MTYPE={0x8}, @NLBL_CALIPSO_A_DOI={0x8}]}, 0x24}, 0x1, 0x0, 0x0, 0x4090}, 0x240040c0) r7 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000a00), r1) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, r7, 0x1a6eee6dfa759078, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40000) (async) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r1, &(0x7f0000000ac0)={&(0x7f00000009c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000a80)={&(0x7f0000000a40)={0x14, r7, 0x1a6eee6dfa759078, 0x70bd2d, 0x25dfdbfe, {}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x40000) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000b40), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000b80)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TDLS_CANCEL_CHANNEL_SWITCH(r8, &(0x7f0000000c40)={&(0x7f0000000b00)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000c00)={&(0x7f0000000bc0)={0x34, r9, 0x200, 0x70bd25, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_MAC={0xa}, @NL80211_ATTR_MAC={0xa}]}, 0x34}, 0x1, 0x0, 0x0, 0x20040000}, 0x22) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000c80)={'wpan1\x00'}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r1, &(0x7f0000000d80)={&(0x7f0000000cc0), 0xc, &(0x7f0000000d40)={&(0x7f0000000d00)={0x20, r7, 0x300, 0x70bd26, 0x25dfdbfe, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x400c810}, 0x4c0d5) r11 = syz_genetlink_get_family_id$devlink(&(0x7f0000000e00), r8) sendmsg$DEVLINK_CMD_TRAP_SET(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001040)={&(0x7f0000000e40)={0x1dc, r11, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x4001}, 0x4814) (async) sendmsg$DEVLINK_CMD_TRAP_SET(0xffffffffffffffff, &(0x7f0000001080)={&(0x7f0000000dc0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001040)={&(0x7f0000000e40)={0x1dc, r11, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [{@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5, 0x83, 0x1}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}, {@pci={{0x8}, {0x11}}, {0x1c}, {0x5}}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x4001}, 0x4814) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$ipvs(&(0x7f0000001100), r8) sendmsg$IPVS_CMD_GET_DEST(r12, &(0x7f00000012c0)={&(0x7f00000010c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000001280)={&(0x7f0000001140)={0x12c, r13, 0x2, 0x70bd2b, 0x25dfdbff, {}, [@IPVS_CMD_ATTR_SERVICE={0x34, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e20}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x38}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x5f}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e24}, @IPVS_SVC_ATTR_FWMARK={0x8, 0x5, 0x4}, @IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}]}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x37}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xa3a}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3a}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8000}, @IPVS_CMD_ATTR_DEST={0x14, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x6}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7fffffff}, @IPVS_CMD_ATTR_DAEMON={0x3c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e24}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x2}, @IPVS_DAEMON_ATTR_SYNC_MAXLEN={0x6, 0x4, 0x5d}, @IPVS_DAEMON_ATTR_STATE={0x8, 0x1, 0x1}, @IPVS_DAEMON_ATTR_MCAST_TTL={0x5, 0x8, 0xa}, @IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e23}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x3}, @IPVS_CMD_ATTR_SERVICE={0x48, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x21}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0x6}, @IPVS_SVC_ATTR_PORT={0x6, 0x4, 0x4e22}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x15}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@dev={0xac, 0x14, 0x14, 0x18}}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x73}, @IPVS_SVC_ATTR_TIMEOUT={0x8, 0x8, 0xec3}]}]}, 0x12c}, 0x1, 0x0, 0x0, 0x4040880}, 0x20000000) syz_genetlink_get_family_id$nl802154(&(0x7f0000001340), r1) (async) r14 = syz_genetlink_get_family_id$nl802154(&(0x7f0000001340), r1) sendmsg$NL802154_CMD_SET_WPAN_PHY_NETNS(r1, &(0x7f0000001400)={&(0x7f0000001300)={0x10, 0x0, 0x0, 0xaa6a72ee28759772}, 0xc, &(0x7f00000013c0)={&(0x7f0000001380)={0x20, r14, 0x4, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_WPAN_DEV={0xc}]}, 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x80) executing program 3: ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000080)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_AGP_INFO(r0, 0x80386433, &(0x7f00000000c0)=""/80) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_pressure(r1, &(0x7f00000000c0)='memory.pressure\x00', 0x2, 0x0) (async) r2 = openat$cgroup_pressure(r1, &(0x7f00000000c0)='memory.pressure\x00', 0x2, 0x0) write$cgroup_pressure(r2, &(0x7f0000000200)={'full', 0x20, 0x7, 0x20, 0x200000000008}, 0x2f) socket$alg(0x26, 0x5, 0x0) (async) socket$alg(0x26, 0x5, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) syz_open_dev$video4linux(&(0x7f0000000080), 0xff, 0x0) (async) r6 = syz_open_dev$video4linux(&(0x7f0000000080), 0xff, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r6, 0xc0305602, &(0x7f0000003c40)={0x0, 0x5, 0x1014}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="9feb018618"], 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x40, 0x2, {{0x0, 0x200000, 0x0, 0x0, 0xffffffff, 0x8003}, [@TCA_NETEM_LOSS={0x1c, 0x5, 0x0, 0x1, [@NETEM_LOSS_GI={0x18, 0x1, {0x7fffffff, 0x0, 0xfffffffd, 0x100000}}]}, @TCA_NETEM_ECN={0x8, 0x7, 0x1}]}}}]}, 0x70}}, 0x0) socket(0x840000000002, 0x3, 0xfa) (async) r7 = socket(0x840000000002, 0x3, 0xfa) connect$inet(r7, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) (async) connect$inet(r7, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f00000005c0)=@raw={'raw\x00', 0x3c1, 0x3, 0x3a8, 0x180, 0xe000060, 0xffffff6a, 0x180, 0x4, 0x2d8, 0x258, 0x258, 0x2d8, 0x258, 0x3, 0x0, {[{{@ipv6={@empty, @local, [], [], 'wg2\x00', 'rose0\x00'}, 0x0, 0x118, 0x180, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@unspec=@limit={{0x48}, {0x48000000, 0x180}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp_trap\x00', 'syz1\x00'}}}, {{@uncond, 0x0, 0x118, 0x158, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@dst={{0x48}}]}, @common=@inet=@TCPOPTSTRIP={0x40}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) sendmmsg$inet(r7, &(0x7f0000005240), 0x4000095, 0x0) executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x11, 0xc, &(0x7f0000000600)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3477, 0x0, 0x0, 0x0, 0x8}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7535}}]}, &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0xa, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000bc0)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) (async) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f0000000080)=0xf) (async) r3 = fcntl$dupfd(r2, 0x0, r2) (async) ioctl$TCFLSH(r2, 0x400455c8, 0x0) (async) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000200)='#+#\x1a[&\x00', &(0x7f0000000280)='kmem_cache_free\x00', 0x0) (async) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) bpf$PROG_LOAD(0x5, &(0x7f0000000500)={0x0, 0x14, &(0x7f0000000680)=ANY=[@ANYBLOB="da20e0f368ee11b334435b5f16dd64f3d4dbeba6d614e79ee3be33f7b76434cfda0ea1ea9ee416492069217637f2bf921d718c0e616193fc7e95f85d9235c44424d02c291ded7cefa343d58aa0d194a118abca441e491430f0ccf324ddd420107f8aa88d01fde49ffd54c67569aab48d6f534137bbe78f2e3dbfc38f09cd196b363db8de946a356c7cef6ad619e1672fe51b2a6000a24386b58af41cd300143a87b3f623a579e8dd3a94043a272bcb79a97a84a5e79f40c07a83041ea83a2b5b167e1065085a460d955b36d9d9730f7877ada4a548a89bdca9d207bb61f37ce90f9316693f7bd44bd0175da86af912a53bf84fdb71e6a89653d5d5f9", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000010000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000020850000000400000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x40, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) r5 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$ARPT_SO_GET_REVISION_TARGET(r5, 0x0, 0x63, 0x0, &(0x7f0000000000)) (async) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="180000000000000000000000000000008500000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='workqueue_queue_work\x00', r1}, 0x18) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='workqueue_queue_work\x00', r6}, 0x10) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x15, 0x5, 0x2, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) close(r7) (async) r8 = socket(0x400000000010, 0x3, 0x0) (async) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x2}}}]}, 0x38}}, 0x0) (async) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x22, &(0x7f0000000140)={&(0x7f0000000440)=@newtfilter={0x54, 0x2c, 0xd27, 0x70bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r10, {0x4, 0xa}, {}, {0xfff2, 0x2}}, [@filter_kind_options=@f_bpf={{0x8}, {0x28, 0x2, [@TCA_BPF_FLAGS_GEN={0x8, 0x9, 0x2}, @TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0x8, 0xb}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x8848}, 0x20004804) (async) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000300)=0x2) (async) ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000001c0)) ioctl$TIOCSTI(r2, 0x5412, &(0x7f00000000c0)=0xe) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000040)=0x2) (async) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000240)=0xfe) executing program 4: sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0xbe, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0xa010102, @local}, {0x0, 0x4e32, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "00000000000000000000000000000000000000000000feffffff00", '\x00', '\x00', {'\x00', "000000000000000000009b7e00"}}}}}}}, 0x0) executing program 4: r0 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r0, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000006, 0x4132, 0xffffffffffffffff, 0x0) open(&(0x7f0000000080)='./bus\x00', 0x400141042, 0x0) mount(&(0x7f00000002c0)=@nullb, &(0x7f0000000140)='./bus\x00', 0x0, 0x1000, 0x0) r1 = open(&(0x7f00000005c0)='./bus\x00', 0x145842, 0x0) r2 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) bind$llc(r2, &(0x7f0000000040)={0x1a, 0x1, 0x0, 0x54, 0xcb, 0xfe, @remote}, 0x10) pwritev2(r1, &(0x7f0000000240)=[{&(0x7f0000000000)="85", 0x100000}], 0x2, 0x0, 0x0, 0xb) executing program 4: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_elf64(r0, &(0x7f0000000000)=ANY=[], 0x10132) recvmmsg(r1, &(0x7f0000004380)=[{{&(0x7f0000000180)=@ethernet={0x0, @multicast}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000300)=""/249, 0xf9}], 0x1, &(0x7f0000000400)=""/255, 0xff}, 0x32}, {{0x0, 0x0, &(0x7f0000001b80)=[{&(0x7f0000000b80)=""/4096, 0x1000}, {&(0x7f00000005c0)=""/161, 0xa1}, {&(0x7f0000000680)=""/65, 0x41}, {&(0x7f0000000700)=""/243, 0xf3}, {&(0x7f0000000800)=""/228, 0xe4}, {&(0x7f0000000980)=""/88, 0x58}], 0x6, &(0x7f0000001c00)=""/181, 0xb5}, 0x8c}, {{0x0, 0x0, &(0x7f0000000500)=[{&(0x7f0000001cc0)=""/212, 0xd4}, {&(0x7f0000001dc0)=""/173, 0xad}, {&(0x7f0000001e80)=""/4096, 0x1000}], 0x3}, 0x9}, {{&(0x7f0000002e80)=@in6={0xa, 0x0, 0x0, @private0}, 0x80, &(0x7f0000004200)=[{&(0x7f0000002f00)=""/4096, 0x1000}, {&(0x7f0000003f00)=""/187, 0xbb}, {&(0x7f0000003fc0)=""/246, 0xf6}, {&(0x7f00000040c0)=""/153, 0x99}, {&(0x7f0000004180)=""/105, 0x69}], 0x5, &(0x7f0000004280)=""/230, 0xe6}, 0xf4e}], 0x4, 0x40012101, &(0x7f0000000900)) (async) setsockopt$sock_int(r1, 0x1, 0x10, &(0x7f0000000100)=0xffff, 0x4) recvmmsg(r1, &(0x7f0000005cc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000ac0)=""/154, 0x9a}, 0x3}], 0x1, 0x142, 0x0) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)=0x0) timer_gettime(r2, &(0x7f00000000c0)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000240), 0x3af4701e) r4 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x9c, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r5, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x6c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0xfd, [0x5, 0x4, 0x6, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0xffff], [0x0, 0x8, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x4}, @TCA_TAPRIO_ATTR_SCHED_CYCLE_TIME={0xc, 0x8, 0x1}]}}]}, 0x9c}}, 0x20000000) r7 = fsopen(&(0x7f0000000000)='pstore\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000080)='ps\x8f?\xaf\xe6\x1e', &(0x7f0000000240)='pstore\x00\x96J\x12\xec$BZ\xeba \x1a\bYW\xe2\xd4\xc0!\xa9\xd6\x03\x11\xc6q<_\"\x98\xa3=8\xfe\xf73qt\x1cwd~\x17*\\aD\xc8\x15\x04Sn{\xe8\xb6`\x1f\xeb\x9a\xbe3\x1d@OK\xc2}\xf7\x91\xcd*\xc9\xc1{}-\x8e\xb6\xc2\xdb\xbb\x7f\xcdE\xb9\xd9[5\x8fp\x8f\xf5\xa3\xf8T\x05\xf9 6\x1al^\x7f\xae/\xa4\x9b\x11[[~H\xca>z\x8b\xe0&\xe6M\xc0\x91K\xc2\xdcW\x82\xe5\x93%\xff\x00\x7f\xef\xed\x04\xd3\xac\xd4\xa7!N\x1e\xa3\xf4\x03\xfa7\xc8\xcdu\xe4\xb0m\xd0H\x87}d\x04\xe1\xe9\xb0', 0x0) (async) r8 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000940), r9) sendmsg$IEEE802154_LLSEC_SETPARAMS(r9, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x28, r10, 0x1, 0x70bd24, 0x25dfdbfe, {}, [@IEEE802154_ATTR_LLSEC_SECLEVEL={0x5, 0x2a, 0x43}, @IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008080}, 0x20044004) r11 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r8, r11, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000540)="450f0172060f20d835080000000f22d826660fc734b1c744240205000000ff2c2466ba2100ec2ed8ecf2450f00d166baf80cb8ca7f2987ef66bafc0c0f38f6ac170080000066b890008ed866ba6100b000ee440f01f8", 0x51}], 0xaaaaaaaaaaaab32, 0x62, 0x0, 0x0) (async) ioctl$KVM_RUN(r11, 0xae80, 0x0) executing program 4: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000040), r0) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={0x38, r1, 0x1, 0x0, 0x0, {0x4}, [@NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'bond0\x00'}, @NLBL_UNLABEL_A_IPV4MASK={0x8, 0x5, @empty}]}, 0x38}}, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_SET(r2, &(0x7f00000017c0)={0x0, 0x0, &(0x7f0000000a80)={&(0x7f0000003680)={0x28, 0x3, 0x8, 0x401, 0x0, 0x0, {0x7, 0x0, 0x9}, [@CTA_TIMEOUT_DATA={0xc, 0x4, 0x0, 0x1, @gre=[@CTA_TIMEOUT_GRE_UNREPLIED={0x8, 0x1, 0x1, 0x0, 0x48}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}]}, 0x28}}, 0x20040890) executing program 4: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r6, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) executing program 3: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a010300000000000000000100fffd2c00010073797a300000000040000000030a01020000000000000000010000000900030073797a3200000000140004800800024032658aeb08000140000000010900010073797a300000000044000000060a010400000000000001040100000008000b40000000000900010073797a30000000001c000480180001800d00010073796e70726f7879000000000400028014000000110001"], 0xcc}}, 0x0) executing program 3: openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='io.stat\x00', 0x26e1, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x87}]}, &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r0, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) io_submit(0x0, 0x1, &(0x7f0000000380)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x2, 0x0, 0xffffffffffffffff, 0x0}]) r1 = io_uring_setup(0x30dc, &(0x7f0000000600)={0x0, 0x0, 0x40, 0x2, 0x300}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r1, 0xb, &(0x7f00000000c0), 0x4f) executing program 3: sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0xbe, &(0x7f00000000c0)={@local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @private=0xa010102, @local}, {0x0, 0x4e32, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "00000000000000000000000000000000000000000000000000000000000100", '\x00', '\x00', {'\x00', "000000000000000000009b7e00"}}}}}}}, 0x0) executing program 3: setsockopt$CAN_RAW_ERR_FILTER(0xffffffffffffffff, 0x65, 0x7, &(0x7f00000001c0)=0x8, 0x4) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_MSFILTER(r1, 0x29, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="01"], 0x310) r2 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r2, 0x7a7, &(0x7f0000000080)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r2, 0x7a0, &(0x7f0000000000)={@my=0x0}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000f0f000000000700000a20000000000a01030000000000000000010000000900010073797a310000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000050900010073797a31000000003c000000050a01020000000000000000010000000c00024000000000000000010900010073797a3100000000040004800b0007"], 0xc4}}, 0x0) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r2, 0x7ab, &(0x7f0000000140)={&(0x7f0000000780)={{@my=0x0, 0x6}, {@local}, 0xfffffffffffffe40, "884fbe2726aa0a32f3e65f909acda971a093228292456e0332e6c11577b514f0bb8db731789d860e9589c4cbdd60b7a851a8a3c55ada2f90c51a69bf4a5c3e32296535dc838ef00dc18a32a79118dc858628f7417a7ca9015083cfff5d16156ef9cabf4f60c0da46870a10bf520cc5abcf9e3a437761ea75776763139fadd55c46daf5338870951822f6a803ccfbab9c3f507672d7c39ea9ccf81d9bc2b4649e7b44ed9fd7cb9bd389240cd41c415113d1caac4507e596d6addad2a4d27ba21a3b655753c508caedcc812ca235a7cd1686426b208bdecf8a4265ba8f6824aa60306e2d623481eed301b6dc21041fa8b6592be00bb74de1989a45a5aa32c189e9f5a5bb878281d0129afcfb8410cd1fa5acd080993d2d084213130a9b8d517d13251e6605a03d9b8faf507e820205a1f471af7b261419e79e09c547f7c10fd3f1ad876f59fdcc5e07d0ff4dee6ea2e3856616a352d648b9b5261b6263020fc3ae8eb404bc25703b3d3b83172d07ff22907d6631d226c8247c92c1826ff814590dfe8c7fc54dfb265e906f756846546316b20e0105e2a5355a210b2b7f5db61d8f90bb783b41ce368233bd08044e9283531fffe49e3d305ecfb16075a047557f57bbd0d60ed8de9cb8adc9f667bcc019db3cfaf310e764d78619cb27fb17af05a0e8ae831ce8413721e71138e62cc4ad8e7974d1506b4fb581c549a3dd7b7ef44ac37201aa3bce6f37f648d781bcb4f329fd45ffa640f1b04efb38a36e0ed0e2abcb07e4ad88ae3edfb6d840d75340204243d0e1c1c3139823b0d5ad196430bf450400000000000000a7e9a9e9c1d97b9f773c921778f2cb5165c02da1423305c502076177e4af50cb3343c10b01b78e3fe5520bdfae2b3dbe42db0f0eb55bbcb19038018d45ccdb8b0df400085a02c61b033f430fb6a7408e090c65798bc49d35e0000000001952d2b3dfd92a2548411e21be26216fe68fc3cf1c6625031260153708a53255b3d3d0411d5f0e8ab2102a97e539c34e9c769a7dafb87c5918deb59ef05e928c2c52775de467fa843cbcdabc290097eeb2ee7c58d86e3fccc39a5b694c18a4cc0d6af1e61d9c69e6466bc0cbef15365109e4f67a6268625f8c3f358fb7d567cbea52e1bc289bd8effda4e362a729e8cd3064970b97e3530df332ba88e97a14834cfd8dc86b5d2f9b35425a4162e6abe8b785ef462883e716c91b8eb281d81f68f606f16fcbc5cddfdec3b515818a647d86a4c17bae6ad525e95598052c49cdee821ceb45b2350dda13628db0dd266f30285241a2b147d65113b8ed3665a3451f7a56cf430ec98aeac702d9b9f776d97520a9d039e5b2fff34ac4d4e0a32e1f35c8f38e4f4fe1b3212a70f185ad71ec86b8c900"}, 0x418, 0x2}) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYRES64=0x0, @ANYRES32=0x0, @ANYRES16=r1, @ANYRESDEC=r3, @ANYRES8=r1], 0x48}}, 0x80) r4 = syz_init_net_socket$ax25(0x3, 0x5, 0xce) getsockopt$ax25_int(r4, 0x101, 0x0, &(0x7f00000003c0), &(0x7f0000000400)=0x4) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r2, 0x7a8, &(0x7f0000000240)={{@host, 0xe}, @host, 0x8, 0x8, 0xfffffffffffffff6, 0x200, 0x6, 0xfffffffc, 0xfffffffe}) sendmmsg$inet(r0, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) fcntl$getown(r2, 0x9) executing program 3: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000300), 0x800c0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x34, r1, 0x1, 0x70bd2b, 0x0, {{}, {}, {0x18, 0x17, {0x0, 0xfffffffd, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}}, 0x10) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) r2 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_opts(r2, 0x0, 0x4, 0x0, &(0x7f0000000240)=0x28) keyctl$session_to_parent(0x12) keyctl$session_to_parent(0x12) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x28, r3, 0x100, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x24008841}, 0x20000800) chdir(&(0x7f0000000100)='./file0\x00') rmdir(&(0x7f0000000080)='./file2\x00') executing program 53: mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000000300), 0x800c0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x34, r1, 0x1, 0x70bd2b, 0x0, {{}, {}, {0x18, 0x17, {0x0, 0xfffffffd, @l2={'eth', 0x3a, 'gre0\x00'}}}}}, 0x34}}, 0x10) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) r2 = socket$inet(0x2, 0x1, 0x0) getsockopt$inet_opts(r2, 0x0, 0x4, 0x0, &(0x7f0000000240)=0x28) keyctl$session_to_parent(0x12) keyctl$session_to_parent(0x12) r3 = syz_genetlink_get_family_id$tipc(&(0x7f0000000140), r0) sendmsg$TIPC_CMD_RESET_LINK_STATS(r0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000280)={&(0x7f0000000180)={0x28, r3, 0x100, 0x70bd2a, 0x25dfdbfb, {{}, {}, {0xc, 0x14, 'syz1\x00'}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x24008841}, 0x20000800) chdir(&(0x7f0000000100)='./file0\x00') rmdir(&(0x7f0000000080)='./file2\x00') executing program 54: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r6, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 33 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r6, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program crashed: KASAN: global-out-of-bounds Read in fib6_ifdown single: successfully extracted reproducer found reproducer with 14 syscalls minimizing guilty program testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet detailed listing: executing program 0: socket$netlink(0x10, 0x3, 0x0) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, 0x0, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) getsockname$packet(0xffffffffffffffff, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r6, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r2, r1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r6, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r6, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, 0xffffffffffffffff, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r6, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(0xffffffffffffffff, r1, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-openat$binderfs-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r5 = socket(0x2a, 0x2, 0x0) getsockname$packet(r5, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r6, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, 0xffffffffffffffff, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program crashed: KASAN: slab-use-after-free Write in binderfs_evict_inode testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, 0x0) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x70, 0x18, &(0x7f00000002c0)={@ptr={0x70742a85, 0x0, 0x0, 0x0, 0x2, 0x1d}, @ptr={0x70742a85, 0xf0ff, 0x0, 0x0, 0x0, 0xffffffffffffffff}, @fda={0x66646185, 0x6, 0x1, 0xd}}, &(0x7f0000000240)={0x0, 0x28, 0x50}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, 0x0) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program crashed: KASAN: global-out-of-bounds Read in fib6_ifdown testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, 0x0, &(0x7f0000001480)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, 0x0, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={0x0}}, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched program did not crash simplifying guilty program options testing program (duration=2m52.987964511s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash testing program (duration=2m52.987964511s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$binderfs-ioctl$BINDER_SET_CONTEXT_MGR_EXT-openat$binderfs-ioctl$BINDER_WRITE_READ-dup3-openat$binderfs-mmap$binder-ioctl$BINDER_SET_CONTEXT_MGR_EXT-ioctl$BINDER_WRITE_READ-ioctl$BINDER_WRITE_READ-socket-getsockname$packet-sendmsg$nl_route_sched detailed listing: executing program 0: r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x0, 0x2}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000180)={0x4c, 0x0, &(0x7f0000000100)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x30, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) r4 = socket(0x2a, 0x2, 0x0) getsockname$packet(r4, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0xf0b, 0x4004, 0x0, {0x0, 0x0, 0x0, r5, {0xe}, {}, {0xf}}, [@TCA_EGRESS_BLOCK={0x8, 0xe, 0xaf1}]}, 0x2c}}, 0x0) program did not crash reproducing took 2h6m21.831867086s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: global-out-of-bounds in fib6_ifdown+0x7f5/0x8f0 net/ipv6/route.c:4901 Read of size 8 at addr ffffffff9af98530 by task syz-executor/19807 CPU: 3 UID: 0 PID: 19807 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00256-g95d3481af6dc #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 fib6_ifdown+0x7f5/0x8f0 net/ipv6/route.c:4901 fib6_clean_node+0x2a4/0x5b0 net/ipv6/ip6_fib.c:2199 fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2124 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2172 fib6_clean_tree+0xd4/0x110 net/ipv6/ip6_fib.c:2252 __fib6_clean_all+0x107/0x2d0 net/ipv6/ip6_fib.c:2268 rt6_sync_down_dev net/ipv6/route.c:4951 [inline] rt6_disable_ip+0x2ec/0x990 net/ipv6/route.c:4956 addrconf_ifdown.isra.0+0x11d/0x1a90 net/ipv6/addrconf.c:3854 addrconf_notify+0x220/0x19e0 net/ipv6/addrconf.c:3777 notifier_call_chain+0xb9/0x410 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2176 call_netdevice_notifiers_extack net/core/dev.c:2214 [inline] call_netdevice_notifiers net/core/dev.c:2228 [inline] dev_close_many+0x319/0x630 net/core/dev.c:1731 unregister_netdevice_many_notify+0x578/0x26f0 net/core/dev.c:11952 unregister_netdevice_many net/core/dev.c:12046 [inline] unregister_netdevice_queue+0x305/0x3f0 net/core/dev.c:11889 unregister_netdevice include/linux/netdevice.h:3374 [inline] __tun_detach+0x1249/0x1540 drivers/net/tun.c:620 tun_detach drivers/net/tun.c:636 [inline] tun_chr_close+0xc2/0x230 drivers/net/tun.c:3390 __fput+0x3ff/0xb70 fs/file_table.c:465 task_work_run+0x14d/0x240 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xafb/0x2c30 kernel/exit.c:953 do_group_exit+0xd3/0x2a0 kernel/exit.c:1102 get_signal+0x2673/0x26d0 kernel/signal.c:3034 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fae80990887 Code: Unable to access opcode bytes at 0x7fae8099085d. RSP: 002b:00007ffc98e694b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000029 RAX: 0000000000000003 RBX: 0000000000000003 RCX: 00007fae80990887 RDX: 0000000000000006 RSI: 0000000000000001 RDI: 000000000000000a RBP: 00007ffc98e69bec R08: 00007ffc98e694dc R09: 0079746972756365 R10: 00007ffc98e69540 R11: 0000000000000206 R12: 00007fae80b7ec80 R13: 00000000000927c0 R14: 000000000003d637 R15: 00007fae80b80e40 The buggy address belongs to the variable: __key.0+0x30/0x40 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1af98 flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000002000 ffffea00006be608 ffffea00006be608 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner info is not present (never set?) Memory state around the buggy address: ffffffff9af98400: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 ffffffff9af98480: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 >ffffffff9af98500: 00 00 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 ^ ffffffff9af98580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 ffffffff9af98600: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: global-out-of-bounds in fib6_ifdown+0x7f5/0x8f0 net/ipv6/route.c:4901 Read of size 8 at addr ffffffff9af98530 by task syz-executor/19807 CPU: 3 UID: 0 PID: 19807 Comm: syz-executor Not tainted 6.15.0-rc4-syzkaller-00256-g95d3481af6dc #0 PREEMPT(full) Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:408 [inline] print_report+0xc3/0x670 mm/kasan/report.c:521 kasan_report+0xe0/0x110 mm/kasan/report.c:634 fib6_ifdown+0x7f5/0x8f0 net/ipv6/route.c:4901 fib6_clean_node+0x2a4/0x5b0 net/ipv6/ip6_fib.c:2199 fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2124 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2172 fib6_clean_tree+0xd4/0x110 net/ipv6/ip6_fib.c:2252 __fib6_clean_all+0x107/0x2d0 net/ipv6/ip6_fib.c:2268 rt6_sync_down_dev net/ipv6/route.c:4951 [inline] rt6_disable_ip+0x2ec/0x990 net/ipv6/route.c:4956 addrconf_ifdown.isra.0+0x11d/0x1a90 net/ipv6/addrconf.c:3854 addrconf_notify+0x220/0x19e0 net/ipv6/addrconf.c:3777 notifier_call_chain+0xb9/0x410 kernel/notifier.c:85 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:2176 call_netdevice_notifiers_extack net/core/dev.c:2214 [inline] call_netdevice_notifiers net/core/dev.c:2228 [inline] dev_close_many+0x319/0x630 net/core/dev.c:1731 unregister_netdevice_many_notify+0x578/0x26f0 net/core/dev.c:11952 unregister_netdevice_many net/core/dev.c:12046 [inline] unregister_netdevice_queue+0x305/0x3f0 net/core/dev.c:11889 unregister_netdevice include/linux/netdevice.h:3374 [inline] __tun_detach+0x1249/0x1540 drivers/net/tun.c:620 tun_detach drivers/net/tun.c:636 [inline] tun_chr_close+0xc2/0x230 drivers/net/tun.c:3390 __fput+0x3ff/0xb70 fs/file_table.c:465 task_work_run+0x14d/0x240 kernel/task_work.c:227 exit_task_work include/linux/task_work.h:40 [inline] do_exit+0xafb/0x2c30 kernel/exit.c:953 do_group_exit+0xd3/0x2a0 kernel/exit.c:1102 get_signal+0x2673/0x26d0 kernel/signal.c:3034 arch_do_signal_or_restart+0x8f/0x7d0 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x150/0x2a0 kernel/entry/common.c:218 do_syscall_64+0xda/0x260 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7fae80990887 Code: Unable to access opcode bytes at 0x7fae8099085d. RSP: 002b:00007ffc98e694b8 EFLAGS: 00000206 ORIG_RAX: 0000000000000029 RAX: 0000000000000003 RBX: 0000000000000003 RCX: 00007fae80990887 RDX: 0000000000000006 RSI: 0000000000000001 RDI: 000000000000000a RBP: 00007ffc98e69bec R08: 00007ffc98e694dc R09: 0079746972756365 R10: 00007ffc98e69540 R11: 0000000000000206 R12: 00007fae80b7ec80 R13: 00000000000927c0 R14: 000000000003d637 R15: 00007fae80b80e40 The buggy address belongs to the variable: __key.0+0x30/0x40 The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1af98 flags: 0xfff00000002000(reserved|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000002000 ffffea00006be608 ffffea00006be608 0000000000000000 raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner info is not present (never set?) Memory state around the buggy address: ffffffff9af98400: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 ffffffff9af98480: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 >ffffffff9af98500: 00 00 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9 ^ ffffffff9af98580: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f9 ffffffff9af98600: f9 f9 f9 f9 00 00 f9 f9 f9 f9 f9 f9 00 00 f9 f9 ==================================================================