Extracting prog: 5m30.783908264s Minimizing prog: 1h37m16.061012462s Simplifying prog options: 4m42.816519949s Extracting C: 1m52.912624917s Simplifying C: 0s extracting reproducer from 30 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 23, 5, 25, 3, 10, 28, 13, 26, 28, 5, 21, 18, 24, 28, 21, 18, 24, 30, 3, 23, 28, 25, 28, 23, 21, 22, 19, 28, 21] detailed listing: executing program 0: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) openat$nvram(0xffffffffffffff9c, 0x0, 0x88002, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, 0x0, 0x40) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='dyn']) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={@cgroup=r2, 0x2b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="480000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000002800128009000100626f6e640000000018000280140008"], 0x48}}, 0x0) sendmmsg$inet(r3, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000000), 0x208e24b) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000001c0)) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'syz_tun\x00'}) executing program 3: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) ioctl$BLKRRPART(r2, 0x125f, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x800005, 0x11, 0xffffffffffffffff, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @local}, 0x14) executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x1, 0x2, 0x3, 0x2, 0x1, 0x22}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000940)='hugetlb.2MB.usage_in_bytes\x00', 0x26e1, 0x0) close(r0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000029c0)) ioctl$SIOCSIFHWADDR(r0, 0x8b34, 0x0) executing program 3: syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) mknod(&(0x7f0000000540)='./file1\x00', 0x0, 0x0) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') r1 = userfaultfd(0x801) mount$9p_fd(0x0, &(0x7f00000000c0)='./file1\x00', &(0x7f0000000100), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r0}}) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000200)={@map=0x1, 0xffffffffffffffff, 0x9, 0x8, 0x0, @void, @value}, 0x20) syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x0, 0xc, &(0x7f0000000240)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="140000003080ffcf00000000fcdbdf250300000016fa8e3ef952c638928baafe13b2123a6b4c642b0b79d2c8deac4f69e237d8b6d13af56977387c7e844f85f7dcc1172d8ad5fd58fd7336f994674e56ec4b896ba74e515900f50739d44fd9af9b0fee09b25d52cd61b9b44f9d93bbd8c5531e00143ac39bc786819b131d6ba6fb"], 0x14}}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x1) read$msr(r4, &(0x7f0000032680)=""/102392, 0x18ff8) r6 = socket$kcm(0x2, 0x3, 0x84) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, &(0x7f00000013c0)=ANY=[@ANYBLOB="b702000000000000bfa300000000000007030000ffffffff7a0af0fff8ffff5979a4f0ff00000000b7060000ffffffff2d6405000000000065040400014741001404000001007d60b7030000000000006a0a00fe40000900850000001f000000b70000000004000095000000000000006623848adf1dc9a764ab51a064e0ff0c9b27a26293fddf0180000071ff31f1622271d5518193e09483c5a020c334f8c76334d8ce8303b01ddaa52e8756ad60a07d6f27c125e16d024098f755d8583da60f27c162dbba0700002ac9170f50f2568836077b7f711a18ebf608d87b885297b6a79819782748b376358c33c9f53bfd989b1ca58949a54d5827df14feecea46408a05d572077f1252fbb72c3d099c501bc4ded6fca17a3447222c95edb47b77aafa63b9dd5fa5c53e9c37251709f1ff7f0000f07bf7f53ce129a9ecd3b4dd15100f2b450f98526a0d8cac7c97fc2f64015306a1bd7e43fe1ca8345710fb6379b4c53cf55eefb4c0974486a8d25a363adbd83b49e13fbd1777b27020bd9b8cff3f48c9411670c34f23ab8caf7851b290feb3045a1b622f20c4383a0280f040de7667f8b1d0842835e81c358ebe73af41e5b5b924275cb1749289b44e9728e7a73f148ac8206afe120c1437490d99000000110000fdffffffffffffffaf580278e1342aabd1b623f6c4f128858e4eb6b42f2173184c2b99b645f6ec0e14e5d7c95a0008000000f30f6c0000000000ff0000b8f5001a1d2a34dc0973ec302bc23211d3e3b6e6dad65a51e5497a3419cecec38126247b27113ad4c7915c8f82c333a7b350802f0311807010d1ed50c18411aa6900daccc02f4ba4b078f07e41f781eee222c7d071d5a94d82ca9a0846c1af59cee16639b4970f8f0a82c6a712fd5722d637d406160ffaffffffb4e0bde6749aa52c408b74251914c5d3255fd88a42e7ebb69ebcd8eee623e51dbb1f1b548c91a6825c0686fdc16be1cbb72c217fda18bd746253ca66093daf35923300b600000000ac376e0a4649a8a84e1d293a6b109c5e59b366bca5cc3d936c53d4a48c05099e6fc36d5aa23bff8cce0600fcff00000300a568a8532623d12b40b50ac26f2e8255470a04bfbe7acb581b90991d965a01d1f84cb6b973558e1e3f8118c77ccf0b3c6eb6443870004da10c75723b65f83769ad1f0e4ef6b9ef1cec23264fd8fdac6264af1cb467020bdc12b797b6c156c439105829d2ae1c45f7cfa40df68fd36a03353a55a8a89b60317cd78ea1dc8e0f77f2c1e68ec7c01bd5a2028a8fc107007f3deb1f200abe1f753754678dae8b4e3ba3d086d4b95dfc5817e3dafae2d38b522f942cc750399d90296171fdb1e05882f8a4b8fbd219ccac3a895828b4f22b6527ce31ceb02b7b2b4492510134552f0b076b168394f8417f25cc82ae04007193cbe69de8bf35e4bebd15412426b2e20ab1f05fc44ae9ae094c1b81d3ef947692b44d2afb09c7498dedf0f87c38bbcab7357836f03e8a7c392e535694a3ead2de11e6b1781e2a018c0ada7bc7f0eb2d678f23c07ac341fda2e563ee95085742f5fee9f95f4741b226e428d20b00bc140000e4b2f5efd0a0b1ceba000830ba8634b5aa26bdbe91614e92fae3c7349531df9bf4c01ebf5d8eb7d53e5f30647661623fbdb3f60033fc32f68ea86a2df1e76fe27dfdff1cf9194849c4cc0da9533e5983693e526a7dc0d8728f3b573ca4427bdb44df9341e9b8050e896598a156c935c800436a312e7ae3c011e46851ac599f0427729ab9c55ae0ab4c0000000000000000000000000000c87bcc2ac5aed9247b51d92e0993af4beaf1f3f47dcdfab9165f98155d93e383d6b85158b54675c1585037508c1e9461a1c3d1a6e2402045cae150a7016f1a90716eebbdf6afc4414d900be0bdf19f4a273f44f4357380b4387f1c8b104f0e406b2f04e5ed88631be6411f9927fe9f83412b7c5a676ceec8b454ebf6481c98e86b6933a02daea0b4ec0be5b3d916bd70208b4588626c277648475002e2c62681bd07331422a6e47bbd40857d52c4894944fae5c500000000000000ff00000000de784314b8fd419216b48d0f353c11ae185749fa9ac7dfa16bc5c23a23f74b17a7f1b2d799480f33faa3537a910d6ca02f48b0e69beb1119f106ea59195dbc72e17a5dc8c3d131d82f067e29dc39665dff39fb6347b374aaaf6e65efde3f8f26283bcd93e80cacc6202bf29ccfcb08caf18d668a462493aa82e76affba9c9af31d1c23237aa6eccfadfaf794bb1004c07b21ac6ed77718098b2f722bd05fea3561b86b2838a8de5b4f91d6aba95dc9f4464a024be4d0d8d04f5023e7e19e503624d39a43c7b310de519b40738ff9a623065c06d69d16d4a46ff300022fee47803989b7e916254e0fb9e1c8b07d8a4b8b692a75a32e6ed2caeaa7c258c47fe6143cd9e90b801eff78cd4e402374e0e4ca07b7f17254e3d2f0a2a1bac6fde8a15e3ef3588065524d41966fb3915e804c53201efee751ec294584d23d9008bdf046f55c030ab941a0b8723412127efb3eac0ccf68133c76770d5e7dabcc48d47685404cc540535ed70df75c24660d85f9c9a245185c7da217d1c3743db85db67b9b8a8f00af02367429f6f0b53c169c4356751bf68745dbde055e1522ae256ae53ae637a1431855d16dfa91d82a021a4b2dbb50bf6d59fdd0c9bc84cd7b544de2523b6ce8aaeb94bfba75079f7455204ccca02bd389d8409b2effe9b88e301ac4fe28752386a0678a3f54b2bdf56f927ddd6b0ac98b2b505f668597455ada51ba95ab852b49373a11ff310601bcdd23acb4c01bcd2f3e1ad378d14c07d923087d3518369710b70ffb0b523dc4f00f275c381fe1c091e478b04d5e4a9f75b4072acb005a83c25625ab7affffffff7177e27a1bf112114eb10250c2b9dca234f8967f0439696a2345e747b5f1d8c4bec86d8e8f2eb121ea0159615e7d475d45837921c2c0c3f9e683ac8000214a657c9f0a00000000000000159596ac570c4b889106f937d56b2346c818917b727bf5e2741068ec000000000000000000ec84"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000880), 0xfffffffffffffddd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000300)={r7, 0xe0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000840)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffd6e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x4) sendmsg$inet(r6, &(0x7f0000000140)={&(0x7f0000000240)={0x2, 0x4e22, @multicast1}, 0x10, 0x0, 0x0, &(0x7f0000000580)=[@ip_pktinfo={{0x1c, 0x0, 0x8, {r8, @dev={0xac, 0x14, 0x14, 0x28}, @multicast2}}}], 0x20}, 0x0) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) sendto$inet6(r2, &(0x7f0000000000)="eb", 0x1, 0x0, &(0x7f0000000240)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) executing program 0: syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000002505a1a440000102030109025c0002010000000904000001a3f45747d649f9a30105240000000d240f810000"], 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) executing program 2: ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, &(0x7f00000002c0)) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=ANY=[@ANYBLOB="4400000010000104a5270b7357000000925e4a44", @ANYRES32, @ANYBLOB="0dfa130016000000240012000c00010000000000000000000c0002f60800000001180000080001"], 0x44}}, 0x0) r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="4800000010000507000000000000000000000002", @ANYRES32=r1], 0x48}}, 0x0) r2 = socket(0x1, 0x803, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$team(&(0x7f00000003c0), 0xffffffffffffffff) sendmsg$TEAM_CMD_OPTIONS_SET(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000440)=ANY=[@ANYBLOB='d\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01062bbd7000000000000100000008000100", @ANYRES32=r3, @ANYBLOB="4800028044000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000"], 0x64}, 0x1, 0x0, 0x0, 0x8001}, 0x20040090) executing program 2: syz_open_dev$dmmidi(0x0, 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000000480), 0x2, 0x80042) dup(r0) r1 = io_uring_setup(0x4e8f, 0x0) close(r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x19, 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) r3 = syz_open_dev$usbfs(&(0x7f0000000040), 0x80000000003, 0x101301) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="c5c3442e25f3aaaaaabaaaaa08004500001c"], 0x0) ioctl$USBDEVFS_FREE_STREAMS(r3, 0x802c550a, &(0x7f0000000000)=ANY=[@ANYBLOB="0200a006002a17006000000002000020"]) r4 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000280)=0x2, 0x4) setsockopt$TIPC_CONN_TIMEOUT(r4, 0x10f, 0x82, &(0x7f0000000100), 0x4) sendmsg$tipc(r4, &(0x7f0000001680)={&(0x7f0000000000)=@id, 0x10, 0x0}, 0x0) connect$tipc(r4, &(0x7f0000000140)=@id, 0x10) capset(&(0x7f0000000000)={0x20080522}, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r5, &(0x7f00000065c0)=[{{&(0x7f0000000440)={0xa, 0x4e23, 0x0, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="12000000000000001100000067"], 0x22}}], 0x1, 0x0) executing program 3: socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r1, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r3, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg$unix(r2, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000080), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r5, 0x0, 0x0) recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000900), 0x100}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r7, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001dc0)=""/4096, 0x1000}, 0x0) memfd_create(&(0x7f0000000480)='\x02\a\xc5(\xec[r\xe1:', 0x0) executing program 2: openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) setsockopt$pppl2tp_PPPOL2TP_SO_RECVSEQ(0xffffffffffffffff, 0x111, 0x2, 0x1, 0x4) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$usbmon(&(0x7f0000000040), 0x0, 0x0) openat$urandom(0xffffffffffffff9c, &(0x7f0000000180), 0x8800, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_GET_MSRS(r3, 0xc048aeca, &(0x7f0000000200)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r4, 0x0, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000240)) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) syz_genetlink_get_family_id$netlbl_cipso(0x0, 0xffffffffffffffff) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x0, 0x1) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x8, 0xa, &(0x7f0000000680)=ANY=[@ANYBLOB="18020000dfff00000000000000000000851000000600000018000000", @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00d\x00\x00'], &(0x7f00000000c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000600)={r5, 0x51, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3a, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x68) mount(&(0x7f0000000100)=@nullb, &(0x7f00000002c0)='./file0\x00', &(0x7f0000000080)='iso9660\x00', 0x0, &(0x7f0000000340)) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$netlink(0x10, 0x3, 0xf) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0xffffffffffffffa3, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYRESOCT, @ANYRES32=r1, @ANYRES32=r0], 0x14}}, 0x4004010) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000200)) sendmsg$nl_generic(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={0x0, 0x2dd8}, 0x1, 0x0, 0x0, 0x20040841}, 0x20044) io_setup(0x6, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x3, @any, 0x803}, 0xe) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000340)={0xffffffffffffffff, r4, 0x8, 0x0, 0x0, 0x3, 0x0, 0x46d, 0xfff9, 0x3, 0x0, 0x8, 'syz0\x00'}) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x119a000, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socket$inet6(0xa, 0x6, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000580)='tracefs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r5 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) getdents64(r5, 0x0, 0xfe0f) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') lseek(r6, 0x9, 0x0) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x7) executing program 1: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x0, 0x13100}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) sendmmsg$inet6(r0, &(0x7f00000012c0)=[{{&(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, &(0x7f0000000240)=[{&(0x7f00000000c0)="1c", 0x1}], 0x1}}], 0x1, 0x0) executing program 4: openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x3) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) getpgid(0xffffffffffffffff) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000540), 0x2, 0x0) io_setup(0xf8, &(0x7f0000000400)=0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) io_submit(r2, 0x1, &(0x7f00000001c0)=[0x0]) sendto$inet(r3, 0x0, 0x0, 0x200047ee, 0x0, 0x0) setsockopt$inet_tcp_int(r3, 0x6, 0x19, &(0x7f0000000200)=0x6, 0x4) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f0000000000)={0x0, 'pimreg1\x00', {0x3}, 0x4000}) write$RDMA_USER_CM_CMD_RESOLVE_IP(r1, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x4e21, 0x0, @loopback}, {0xa, 0x0, 0x0, @remote}}}, 0x48) executing program 0: socket$packet(0x11, 0x2, 0x300) fcntl$addseals(0xffffffffffffffff, 0x409, 0x7) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000040)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x410000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_dev$sndctrl(0x0, 0x1, 0x6c40) syz_open_dev$radio(0x0, 0x2, 0x2) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r1, &(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc) socket$inet6(0xa, 0x3, 0x7) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000ac0), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000b00)={0x0, "abacd211119ca94c63377526aeb5ab2c7b9ca5fa07558139ede6dc06270ee042", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r3, 0xc0303e03, &(0x7f0000000280)={"cb02c6d8cb00fc18137f1cadfe97a31b251f7340a0e800", r3, 0xffffffffffffffff}) io_setup(0x8, &(0x7f0000004200)=0x0) io_submit(r5, 0x1, &(0x7f0000000100)=[&(0x7f0000004280)={0x300, 0x0, 0x0, 0x5, 0x0, r4, 0x0}]) executing program 3: r0 = creat(&(0x7f0000000040)='./file0\x00', 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000240), r0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000006600)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_GET_KEY(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000006740)={&(0x7f00000002c0)={0x2c, r2, 0x1, 0x0, 0x80000000, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x5}, @NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x1}]}, 0x2c}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0xfffff7e8}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0x3, 0x9, 0xd, 0x401, 0x4}, 0x3}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x88}}, 0x0) mkdir(0x0, 0x0) mkdir(0x0, 0x0) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x2040, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r5, 0xc0189379, &(0x7f0000000040)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x8002, 0x0) setsockopt$packet_tx_ring(r0, 0x107, 0xd, &(0x7f00000000c0)=@req={0x7, 0x1, 0x7, 0x3}, 0x10) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f0000000080)={0x1, 0x5}, 0x2) write$USERIO_CMD_REGISTER(r6, &(0x7f0000001780), 0x2) close_range(r0, 0xffffffffffffffff, 0x0) r7 = socket$inet_sctp(0x2, 0x1, 0x84) sendmmsg$inet_sctp(r7, &(0x7f0000006300)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000003140)=[@prinfo={0x18, 0x84, 0x5, {0x30, 0xffff}}], 0x18, 0x4000}], 0x1, 0x40040) executing program 1: prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) openat$nvram(0xffffffffffffff9c, 0x0, 0x88002, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000000c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) sendmsg$NFNL_MSG_CTHELPER_GET(0xffffffffffffffff, 0x0, 0x40) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$afs(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000580)=ANY=[@ANYBLOB='dyn']) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000180)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000140)={@cgroup=r2, 0x2b, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$PROG_LOAD(0x5, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[], 0x48}}, 0x0) sendmmsg$inet(r3, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}}], 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f0000000000), 0x208e24b) ioctl$sock_inet6_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000001c0)) socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'syz_tun\x00'}) executing program 2: syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r4 = syz_open_procfs(0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, 0xffffffffffffffff, 0x0) fstat(r4, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000000040)=@newpolicy={0xb8, 0x13, 0x1, 0x0, 0x0, {{@in=@loopback, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x1000, 0x0, 0x0, 0x0, 0x8}, {}, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0xb8}}, 0x0) executing program 3: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000040)=0x0) prlimit64(r0, 0x7, &(0x7f00000002c0)={0x5, 0x8}, 0x0) prlimit64(r0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x1, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mincore(&(0x7f00005b2000/0x3000)=nil, 0x3000, 0x0) syz_open_dev$sndpcmp(0x0, 0x0, 0xa2c65) futex(0x0, 0x80, 0x0, 0x0, 0x0, 0x0) process_vm_readv(r0, &(0x7f0000000500)=[{&(0x7f0000000300)=""/111, 0x6f}, {&(0x7f0000000380)=""/144, 0x90}, {&(0x7f0000000440)=""/144, 0x90}], 0x3, &(0x7f0000000dc0)=[{&(0x7f0000000540)=""/32, 0x20}, {&(0x7f0000000640)=""/208, 0xd0}, {&(0x7f0000000740)=""/151, 0x97}, {&(0x7f0000000580)=""/76, 0x4c}, {&(0x7f0000000800)=""/144, 0x90}, {&(0x7f00000008c0)=""/169, 0xa9}, {&(0x7f0000000e80)=""/254, 0xfe}, {0x0}, {&(0x7f0000000b80)=""/67, 0x43}, {&(0x7f0000000c00)=""/178, 0xb2}], 0xa, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) r2 = openat$cuse(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r3, 0x1, r2, 0x0) socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000600)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000000000c02000000000000000000000d0000000000005f"], 0x0, 0x34, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) executing program 4: r0 = creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddd8) r1 = syz_open_dev$loop(&(0x7f00000001c0), 0x75f, 0x103382) ioctl$LOOP_SET_STATUS(r1, 0x4c02, 0x0) close(r0) r2 = memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\x00\x00\x00\x00\xfb\xff\x00\x00\x81\x9eG\xd9,\xe2\xc6a\x9f\xe8\xf1\xb3\x86\xe2+Op\xd0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf3:\x99\x1e\xac`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\xd2q#\xc6\xca\x97\x9d\xcb\x1e\x80\xd6\xd5%N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec', 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x7, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b702000002000000850000008600000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket(0x1e, 0x805, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='kmem_cache_free\x00'}, 0x10) execveat(r2, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) executing program 1: prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000300)=ANY=[@ANYBLOB="bbbbbbbbbbbb0000000000000800450000300000000000019078ac1e0001ac1414002b00907803000000450000000000000000000000ac1e0001ac1414aa019f112a0d6db06febe7405d453630bc68c573ee62302a3e9c4e2c632aa96b604e9245f3eb669a318e6a2b201dedb21b8c40301130e620977bb8a4f0a4cf4fc007ec334e54d82491119cf665c3a6"], 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_GET_NEXT_KEY(0x2, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) r3 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000000500)={0x100000001, {{0xa, 0xfffc, 0x0, @loopback, 0x2}}}, 0xc7) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000240)=ANY=[@ANYBLOB="01000000000000000a0000000000ff00ff010000000000000000000000000001000001000000000000000000e0ff00000000000000bd0000000000000000000000e4ec010000000040000000000000000000000000000000000000013da51fd47aa2e2f70000000000000000000000000000000000000000000000000000000000000067ff0000000000000005"], 0x310) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000780)=ANY=[@ANYBLOB="01000000000000000a00000000000000ff010000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000000000000ff02000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003500"/401], 0x190) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) clock_gettime(0xfffffffffffffffb, 0x0) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, 0x0) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, 0x0) sendmsg$ETHTOOL_MSG_RINGS_SET(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nfc(&(0x7f0000000100), r4) sendmsg$NFC_CMD_START_POLL(r4, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1700000007000000080000000800000005000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="001a000200000000000000000000000000000000008b00bbd42fef00"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000280)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r5}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x9}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) executing program 2: syz_usb_connect$cdc_ncm(0x4, 0x6e, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000020000002505a1a440000102030109025c0002010000000904000001a3f45747d649f9a30105240000000d240f8100000000000000000006241a00000009058103000000000009040100"], 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) executing program 4: fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socket(0xa, 0x3, 0x3a) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000540)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a40)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a20000000000a03000000000000000000070000000900010073797a300000000064000000090a090400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000003128"], 0xac}}, 0x0) r3 = openat$dsp1(0xffffffffffffff9c, 0x0, 0x2, 0x0) fdatasync(r3) ioctl$SNDCTL_DSP_GETOSPACE(r3, 0x8010500c, &(0x7f0000000280)) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="1800"/16], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r4, 0x0, 0x20000000000000}, 0x18) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$tty1(0xc, 0x4, 0x3) openat$ppp(0xffffffffffffff9c, &(0x7f00000005c0), 0x0, 0x0) syz_emit_vhci(&(0x7f0000000300)=ANY=[@ANYBLOB="042ffd02"], 0x200) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000500)=ANY=[@ANYBLOB="34e00000", @ANYRES64=r0, @ANYBLOB="010029bd7000fedbdf25120000000800080003000000180001801400020076657468315f766972745f776966"], 0x34}, 0x1, 0x0, 0x0, 0x40044}, 0x40000) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) executing program 1: syz_open_dev$dmmidi(0x0, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$amidi(&(0x7f0000000480), 0x2, 0x80042) dup(r0) r1 = io_uring_setup(0x4e8f, 0x0) close(r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_netfilter(0x10, 0x3, 0xc) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) write(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x19, 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000200)={0x48, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}) r3 = syz_open_dev$usbfs(&(0x7f0000000040), 0x80000000003, 0x101301) syz_emit_ethernet(0x2a, &(0x7f0000000000)=ANY=[@ANYBLOB="c5c3442e25f3aaaaaabaaaaa08004500001c"], 0x0) ioctl$USBDEVFS_FREE_STREAMS(r3, 0x802c550a, &(0x7f0000000000)=ANY=[@ANYBLOB="0200a006002a17006000000002000020"]) r4 = socket$tipc(0x1e, 0x5, 0x0) setsockopt$TIPC_DEST_DROPPABLE(r4, 0x10f, 0x81, &(0x7f0000000280)=0x2, 0x4) setsockopt$TIPC_CONN_TIMEOUT(r4, 0x10f, 0x82, &(0x7f0000000100), 0x4) sendmsg$tipc(r4, &(0x7f0000001680)={&(0x7f0000000000)=@id, 0x10, 0x0}, 0x0) connect$tipc(r4, &(0x7f0000000140)=@id, 0x10) capset(&(0x7f0000000000)={0x20080522}, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) sendmmsg$inet6(r5, &(0x7f00000065c0)=[{{&(0x7f0000000440)={0xa, 0x4e23, 0x0, @remote}, 0x1c, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="12000000000000001100000067"], 0x22}}], 0x1, 0x0) executing program 3: syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f167dc13b91488654db734565687ba29a55a5cf0de6ef6178765434a73b7e69376c86cab0333bc140d7ceaf01671d44a36dfb570ec21d91df40d35750c51ae159e404a8391d860b7a6692294dded0d5dbeb02d6e555f76512fdb42771e9858548ebc71dd02dc932fa5f16428e3a4ceedad97aa2d13dc5e829e891cd64132e0fed1cc1e12b978a77c4ce35928eb1c06e0c776e37248f9eccfacdc0d8e2ddd821cd68bceb3cc9e65be89a81f74b451a13fd613dcf71c04a07527fafe86d1340827fc3ab3cec786d0a733da9bce4131288c5d3f11f1e5bc7ac7aa83ce043553a"], 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) sendmsg$can_bcm(0xffffffffffffffff, 0x0, 0x200400d0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) open$dir(0x0, 0x2, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x50) ioctl$SNDRV_PCM_IOCTL_REWIND(0xffffffffffffffff, 0x40044160, 0x0) r2 = syz_open_dev$dri(0x0, 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r2, 0xc01064b5, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(r2, 0xc02064b6, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_SYNCOBJ_TIMELINE_WAIT(0xffffffffffffffff, 0xc02864ca, &(0x7f0000000340)={&(0x7f0000000480), 0x0}) r3 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000080)={@private0, 0x8000000, 0x0, 0xff, 0x1}, 0x20) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r3, 0x29, 0x20, &(0x7f0000000000)={@remote, 0x0, 0x0, 0x1, 0xb, 0xfffd}, 0x20) ioctl$DRM_IOCTL_MODE_ATOMIC(r2, 0xc03864bc, 0x0) write(0xffffffffffffffff, 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x8cb83, 0x0) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$netlink(0x10, 0x3, 0xf) sendmsg$nl_generic(r1, &(0x7f0000000040)={0x0, 0xffffffffffffffa3, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYRESOCT, @ANYRES32=r1, @ANYRES32=r0], 0x14}}, 0x4004010) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000200)) sendmsg$nl_generic(r1, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f000001e500)=ANY=[@ANYBLOB="d82d00001500200028bd7000fcdbdf2514000000e6817ab058e05291175b833dfd26d6fdd5ff41202769186f8372264bb9cec6989c7f8f1953e7d763015039b238367250592f760bc18e0b97a278f8c69cc5a21f4f93a467f32ff6474254fcd0136ae6fe2328825e76440b97dda8b6758db91ca57c5a9ba8cf60c27aea8c919e105820afdca0f7bb24e04abedce7f9a1c7fcc3d44d8dd4f5d2160d14af6f66bd44baf7842a7c0c98fcf27dd6a7f2ba19811136cbca9cca6c702eecf79bf1f6655830916dd4096a91ae015faac807907045c0a8949f3b230f428046a80cc3c48919af0cb22fdcab217a5794394c953fd7a05d03d000c88f12f8ed193c33a990c4722784e2d5ec2422f4144a41242ecf6654fa7d4a408a60572c4c3268649a32b2f799e42d1113b08c9339945a180620b1f28b2c94ba61fb9c5ef1c2dfc91ad34417e16f4401e5887b6ba6e0302591368b216b21a29c64f4f173ee01e4978bcab91be2abdd491e6d2cf32457e23bc1a816e3465665a78c788e4df420f9e3da0bfa8f3bc108af5cdc1ccdbde712b7910726b7005c2fcfc8893c52fdbed5a40231ff2159e0ec1acedac58d072a330cf1c85cdb6a49f9e274e6535e787ce5f616e957ea22dd7fa0351968ed1b59381c103280439a6aac28126a79ce3087e7c3fcbaea4d8f4009f372ba2923a45716c813591ebda868803c6c1a5e53d2608d6d6dafffccd3a5b66e3c1e74a1b9741d4cb52d538ff9fd7ac7ab52d2627c941804294c9652fb1ac22fc7a16a78f87121ce972855c5cc87c4cc2012c2c266a5b35164b0e6ed792e51abf54fd3f5ffbd4017ff8b4709ec2dd9319b78298d812f994504023bb06684a09d5c5b352a70ff444ea894e06197a6ebe287778c11a5e811c01a6cb3b1a0a4960ecbdb5b9734401e1df79a4bed03587fe77668f05dd421dfcbf5847269a5514eb5fe47e04ac52108e104fb4677d7c67f04eda770267f7e31062ef172af338ed345be864e00f7945279adf749eeb70df0eeadc10ac326de2082644ef00e2e4e1bbd5cdc9512c8fffcffa6c7382db1ae4d2064ae1af640fbf178822dda2ff473331c06d98b8d3fc9fc7f64d3072f5e4079c0d8cdcd7500643d5759b434e4003ebd225b4a8ef571bf155fac35105bdb15c9cee1f77e159973c9b508e4be949d6de5c89d21da51d45f93cd8d985976b1ec55d68dcb3cf717f4d28a5824ba16704027577cdb0289e4ae7bccad699d6e625e1d84cb6e6fe6b70338d8a9c19b00138a31187741d887ae03d9d4a0e48686f6b8860553ccc0e3139fe6ff4d1c2c817824c3a18913cde54f470fe0af8c103d22c033fa9247654e76b9465fc440bcef8dbb0cd6699534e9b5cd72510012cc7eaac2ca954e6ee32b1dc5513a8b648850146e0d4d1e7c8a940079dbde580851220e50a7fba977ab6fd855072732b2b901898c18961a4722014a9f736d5d7944c487df96119ca70ea5f52ce555b7f96a6643acf57fa6bba9ecb99bceea806b1faeb230c6a4e65805794300001f531fef397e7f6cdfece6baa2601f3cdd0e26a266fd1da951e2fb75acb262cd007d8c642d1b685a92f4016cf56c344087b8acb4b313ea07d2aa4e3e7f1efdb2a41844bb9988248de52635e76858d8d2d000ff876788d857522a39043f2d62543e8486d100b548637b5526c2c0a153b6e68a942618ae52565e19b2a04e14e88c14e2eb3d76c1c25d9055c872d64dba07eff4a5a15396799d944df6a6d9d1c68d8cbeb3c36c2240d19671a905186b3be248d5d7528ca9945584b50ed95eb5df44d162ca71f6735d05a6438ac17091e0370b22792a91c80991063e8b6da27f7ba6a25fd02977535b245597eba8053948a6934c01e82174349aa241b07ecfcbd91e3238707a4dfccded22817b6acd7940ffa6e78c4ca0e7cca0d18e07dcfb9e5197bf0ae95596da313ab02a6e89b476aee231d385bcc36d9528325fc2776d5aa98c993ced90b4f1d10d631c3944b03f345d5fda29a097ae52f36fdca44b81db228edab5bf9424d56da0f473058ad99fc030e1d6ddfc82ed0b1ef146911ed9b473de0f0a44ab9659d5aad23a1c3c85fd90b43a7e80599fd4df4728ffc5af29da8692b1b08fa6b5dec79115d5267e55ddab9a2d70453aba25a8462463318d18b7523a30650258cbb16c35df9783f428a6c5bff35e720894b7a75798eea9d83729d840fc4bde68b74cd4dffa9b7374236ff1cda6b42b4ed3391ef072c37b16c5ca8b8232f7d551fd8f8182b81fcb457e49a6b8763a8a92889ea3c8979a2ceb422380673259a08dd62d0063bb19b108279a12bff5384faddd757142d65838137ee15b04992b3deb006f6315ceee08ae310928930d055b9b43e5b875f3bb22b287b13f53b17eca621e171b32e0559647aba017ff9c00572691427fbf83f0e8b13c3b6cc1ad6e3b0b18eb479d13f3b3878b0ef5fb97bbbef8be8060a85421799b5b82b035cd7e3a19e2c461c46d5ee62d0701ad5793b037f72e8d361abc4eda65acb732e91eb44145ef0288249b4b25f22e6c6e38c4c48b1a071e07cb4f9237d1091132daa2df9be9ca571538ad60607f26f231c734a2ed32ff30ea692df1424c45e9fd7e8b59789871140bb4611cc9938200add458094a61fa91e50638c7f829fa5d8d781a41ac8006e5a34a0c215b9c7d235b8c89ab833155e0be07a146865488a340b41fc661c601389ac7dac1003e4cc688ee509a135e5f340a06567f6cd8790a275bcc7d7fa99710d3daf66e26ef2cc7b1e53a3dcb6a4aebb7edc1e83292e6fd38d60a8656ed01c27c2fe9f1799d28eb1d9d94322aff79ae147afcd56b21e1349b8f38844c73e98f8dc4c58d652adb8fe00f0ff61fd1c735b8d1a012a968082990880c53445ccc9c2d2a8ec1d9b3056ce713c0fcb1c432fa207a6b2d6affa7a24b7d4309702173ddc8da066ccebdcf99c56c5922383bbda99e3d37720f895aad85e278c449a311c7c2ff3f5370972af1842beed09332bd1a5b2f1793a9e24bd53bdd395a62161267c7c59dbbbc20cfc01d81d68d494137ad3d3b38b5fa92c6556358d868143a7d2abfb9a214baaac47971e7694a1434001f290c8a55d8c609d749bae626ec10eee1b6c22521c4ea2220c39d96561007473bd96b74235a6913ad2fe33edacba2984b4e720673f05a2df8bc2e0f59333362730553882204f87f83efb7c9d21e2a6edcc3e26805849c2a09c8a894941f8f58a105807fe740eddb1ae2918ed9593de9e26799273759550920292c896379d69e4b5bb11b767316ee712d9582fc07c9b07a97336e1fb4f50e9d9ee23901012ea2d4851dfb80082a407fce93eb933b1b001f6e0c9c1e9f178b07041992b0bb773047e17e4d19b91c4f5cdaa2df30168234463ef77b3c86d84fb90d00a2c57569351a331757d58dc532029bbf60727614984ce5ea9c98352085f81d98fac69a146a6793ecabe5610093c1f8fc40e1e386490bd48a2954e95bc7b6aba1c33187e7a2d4e7ee8a1e4bbf48af98dddf42d716edeb85e58dd0c0d78c6e3ab88fc10c21825752efb98dc779fd6eacdbf5701f356bfc3adf15896050bf07724052dd317e5f78e31962d4defea752649426143eb7a02c7cfcefa6d76cb48c001ccf5a44a429a0cf298159ca3f5241f733b2df507b991b7b45a294149b010c0fc2c8acfb8077c4f49308da40952aa92dd6678574ebbe2f984bab60aae3b9208ede8a0b640350b8f10f1e4686a8401b8f106cd70c87145e716f3f27ccbe8937709b9f90f5487d55c1aa24e53b2e7b9b37510a12e7e947fdf43a8326925c5ff76ff4e199ad34bd378a1d5cac228fcd0ada955c4369acdb2d67d2401b7c8bf117ece6cdd414a0a0a43aeb1ed33634300294e5fc26489a4f699985aa463e1b8065316f6b29830ec42b27be9b8763862df0c71221a4fc8a4b4210f50473378bf36e55162609a51f549509c535ed4f6a2808c159663fee1f5f163b083a27bf001e6aeffaeb371b85f37997f11f490fea19e4703ff79afcdcf07713d69c72b4f7380f70068de613b3ee9e6f0367a68d931ef1c3d894e6d76a5d3ba75d998d766b9ff252c26b8715cd8dc3b01832eb4d85fe9bb21db7e4494de6b8521846789b8fc869481874e6adabd36f0f8de6b23dbb30b6ccf298a75aa6c314882fcad8da49cc1a7d70520b4189bdcd1befba8b50d3db2e8b5b871db4ad532c43273bfcc3ae97d2236d4517bb9af3bcabb5ecf937cce7ccbacc17e35749e7df9bb627a5ac86ed3e0336aa71907db48380f15b370c711d1b2492e1e23d1c5ba915c357d0a8e87e4a89c2d9bcb867f2df2fbbda6674ca4ceb6b96f80990ef2b281f32191e481620d4aa858bed2690f44705c62686e608afb748cf3dc24d0971795f24c1e0219c59539c000104bb7f344366cd6363ebb165e5ea6577ac1c7faf287e848cc8f74c9b913116b5c56436e340540932778b1ebd038779d6a93fb5fa0ac09fbe09580212ffb88177fc8872eeb6e1d37211b8eed1bf9dfbf8c56146c74eb4b221fa4d3fc83f79959f9428d26ab7a891090a6e05f3f9f0e5f6c7f7ffb85618c650656e09f36a0c1566ec210566443b626dc2a404ca27e28f44529fcff9652bebdcb8b8c00357685a5d0d2cd49ea88ac09b63d42721258f0d48915ad77ba8bd0317ed936b688d10062c8f16fb53e6c7726f7a6076f259e0e5054368939459b26fd657f165e239d2386a0caa309366143e0650527819b4b9a6abd38776fa8ecdaf0d65a1676de127b3f8c1d112349837faac25664e8c2066bea4fd8e07c144386b409aeede20bbfb116f1ccc7114b9edb472dc3220545deb9755a4e5c44c1e498f30f177aa88adfe72b0f12f322e92fbdfe9cdf472e6833eb01b74d979e9028c7d462608f0fd42c62ae20c784fe437521b58af8e6c308c180d7b76ff850d1115411f80750df746bb5c6c0c9584c3686f4bb29eea6da5a587c4f9af3907bdb85d82da09516c6d13405676f1fe723f09f2119d1a74e877d04a0101b7b3efe926d8549876ada0419f96e2188a1a18a49697788f68c06f99f4e89724e13d6a27970e026e3328f74815c626fdc1de5b503f0e9e690e24d9329d05e91cc15591102f1c3ce4b2d640b71ceb64183c503cf97a7f28e619d6bf839273089636dd2dbb4a5c8ecb540de59815e2407a5d6580e6f00013d1b5653bc98c51f31bff0cf79934ec06d2bbf253f4ffe276857c34da0c52e5701517f92762d17c3c35fefba0ab8eb6bdbf0a694ec6838340b4d7f30dbc50cfefe131d76ed5e8a73dd7fe8b287763bbdee450fb2afe62a2ced3e0ade2c6621b47b8aa9e33117fbf9105abc18f8e83082d550aa0fd6c5e27ffc0822128bd9e8ccf9393f7232c0b0f381bd737c5c0f3bb140ceb593c27f065e995298a1ea792b8e25e067ba09932848da90f89d36fbd5ce8ddfd72b4daa60a4f8345e6a3af63f97bc51237f31e2ba50b789c91d7c07b2beb5721ce27319af762f74996f33a9aefb79fb8daf765462934f67313cbe4b77e97157a853f4c9398a097ac31311383bccb082bcbff3f79fbe883e2f1f9d9995fd76bc31a47749bc5bc00c5309f5eae73f25625340c08aea68e4a0df22e68d901f2d6b77f6708898575fd06103038e28963e22658f66f2c42283e42deb452f5bb1089d010f82ad1f9175aa36fa0e165172ebb16705087eaf9f872b9a4fa010ff24c39305527e00ff2708334def0228a63f1fb497c8780ab0f43739afb0a2b491cd2f59c83f465f235f14594271cfc120f13c39b5889c83ffee16095af9730bcd3d762d41473e6558ef1993f944c3cde080e86c86b185a626b04febd4ca35c0ce5d385167fa5075e821bfc760ed0e0b38dc805cc0946f87c9bf91aaa38801a12ee882d4c581b96fc2842be108bb8627c2f0effd6e91f34352bbc81d41759c821852aff31221315069ff8aa613e4139e838c8e68f9d4de57a85e17e555740ce7aea57a42c66eb28f313becb9a49eca9e701e70bad7602f97c911babdb33cc7a947154b8f00cf10c526dbc85a3c2c5a553088dc5ee0bda847cc41417669b09d4cd6ce9eaae6a654f6a607f74a693b04ce68008643257b7f85c4b276e7fd4897ed94822fb6597420b03ebc41a66a7b85bfa38fe04cd0a59dd0c300cf0d0bc9f7fb8f1f364bec557eb6b0ed1c20d7775fa4b038c82010725f2a6e6939d5acf22d0440b5d1927c5d77681612c8620e60942e9db78667d3aabb016979ef2343ccfc49bc799b45e0831365e653123a4c9e012d3f44d8fa8edf24e1a89d25247e4fb75bf640c0c718bc3c53e84af016778c6bcc19d4a3d3625413fba1117943b38ffbc64d390eab4b7cee7dddd7d2b154991dbbe328a0f7f24cc3152270931de662ea3287e176191edc395911c29c7dd0c474f37607a7f83ef4c6a073af09f769d9c5e042a7451e03680764a38c4da4706f9b847c0c20f1eba7213f5f9ab8d67d5fb8a4dd856bfe39a5f1c076f4d651ba9800400f600148f2144800d85e99d04c9caf456316b3fd8ba496e4adf3b6d3a860c8c5dc09e1f444faccff1f8adefb9d0f1d3c71449fa63d43c7f0602d33e483644a1722d5829c80e7a2e71a87de1086464e5dae7129a4e0067875dc9a352574ebfae1afca09b688c42385fc842ca72cfb57ae4e1366525310eb0b5f99bf044a7389917d508c55ae9d4512ce72dfdb80b870fdf42ef790f765f7c704f0677a5f39707209e96d2e4d6bf642194208adc753b5727b8c5babd15f9d87956cc64c36393a62daee413413b368e30e5a2ac05f7a762a29776f1f97b25f9fc605a31aa9b610359dc780aa2b07094cda9286b661dc5772af5b1e75b6494eab4c583f745218d2b338fef15e74e53af4cf33ffc1aa1a1375cb4df0a74d09f16ca3b0499aa71d107209f85c7464808759950d85667e89d174e2cd464556e25d059a1571e8dbd66d97fd2e85846a4ba9fff9169dbb6ce22dcde2f048111fdf391993923c7d3b5979aec827dc1e0d1862c5b234bce64abae7b802fe7123b07714a1591e3930354a3650519ee1e3797664e767cccd7eae18de3f039782499a2c6e0743ecdc21e928955fab3b9795f34a7a2ffdd9d124d78952c2a825b72ff85979472b0382ca48fbf692f84acc06a0899cfd0a1ba61c9672dd90605167ece0996cb7449a33974b0cadee090e22612f13c7397fb3f90071470c363057f0f0ff5ba70791f86e042eab492882de4df035760c0a1cff60bccb9c42c902304f9f84d75087392ca937cfd2dd71c61eac49d50a33893ef9e50c34d4f2efb3bf6cb309f251227671a9616b39e41e80007c3ae065e100b4bedc164f82ee7aada4722b6fd461f7726af802f15d417d84e4394a3567e001782d628919daaedcc58c1567b2a40d00b9790865470370c3b1e4f2b61e7d66342c2809c63f5276b794e1352f273166c504aba150d2e8300104862413214d03789f120d6278378643c0c4d087ac7bb046ba230f5600c27b029cb1ec3fe41bdf65db57baafc5909a34b65ead2f178b94ec96b92ff09010044af0eca7168a35bc2b2a1475c45fcc0a921d009f19c726eadc39d72e4849e1b9161f9d863e5ce59dc0599a963557e41dc4b4ee8a2f5fc2fd9176e33b96f6060f1da743746352edba5ed163fcf8b235fcf6e9252e440c249a099ee2049eb2550a80a7446997ba033f2bb4fd280b3db2bc8379ae7622843f012d58e4233e3f12461769aef2e710aad9312b723ca22d04d31cbb758b764426d483c1c1c819a62a4ca8d5220079f84a0d921e4edf76ef28886391083a49a87b730059ae10e59cacea73d62a75af7ad1316feb92570e3300a612f14ca743e26a66970adb9f38cbe1e64e6bacd2dd901f31727b67094a00f88a7df10dd59ca6f8cd28840487ffea0be0ebd3984216957c62fca96437ce197e4f07d283263132e83d001806466efce52bb5cdb4a682644146d8a60afc05c19ca4613bd6bd7e87d63cc8c3dc64ef214e77161f70e52aa8ecc007bd2d0fd209d3966f6f1f30550cbf950ef9150b38055023f5f51b964d67d35e19cd87f285d5ce8b3ae8983558f3610ac12422f156b676eb3f61c7aebb9890492e1cc9a0feca71db5847b94e87ce6122126dd4b9fc750a76a92b67cf508087b0138db6cdfcee990a005841e50a6c497c7403c7a04ab0d34718640d431aaf898c37bf25c450687b1798184855d583ecc8a3dae3a5486b748e3af73a96dcbbd27bdec47d64a9136aceabda710495819d1ffafb83dc504d81bc4c62f3c3f40a0d3cf9509ddac75250b385dd18c779480c4167a84ab51aa6497f439e0696578e4650dc121578be967338ec8aae3c430e2497f10ba5610cc83c9f41131806a19a674c18108e7c2a7fcb832d74bca00ca64dc966b0dd1d9ff21e1e974c1625ba8ab8eacf136ed95b041ff240f694356d7442af87e0fbd03c679ed4aad86ed6923e8121646bca68493ad44ba02debe6fe8e9631b0015850a6f4d99f82abbc2c917588b003865acd6c3261f16fde49abcb852a914ef592457051f929b144b1d9af0dab7531613bd2de0d7d66b0b6ea2fd759b0b6e52bd263f372be9281371b3f66806d2df4260785d25d4e8139a072b0daf380663d908c970ad36013a3dddafafcef8f3f3e39cb0acb78c5f54d449d3d6c6f8d0d86a7717367743cc489a042c8324a896c2d09ff58e82b5c6c7090355a88c1e4ed6ba7a15e34a07cb194996d8bdc523fa7036804ef720552ba904ef8b4adaa578fd02c987e662660a756c5c6c33589194a72caf89b371e3115f11a724758a2c7b8f2d569cdc6402fc5cff59d2699aebb2b5592ecf1a1d90c00107185dd5e786b49f530c0a98987a1ea5b1103069fdb4e9deedd012a6a7a9b390e91ec1129511a87a9188192d2cc6667e67b649703aee3345ed6e8182b3edd2402498a1acd00186c995452828954f8bcc88855a5c86792eec3aeccc12e654e06ea4a75a2fdc7a27f8bc8d003fadcd3f7ac916fd33162b393e3f46e897593dd607bf5b2d567465bf34305ea15bb9ebfee695a97a7ecf5fbb4bcbc6bc1ebe29bd4ecc1f6184c2f133d4700af37c45ca98753bb2712065b3dc3a1e90c4a61af7f188c159df30d79723a929734653cf3b19f1d8412ecbebad750e06df76fc0b6d9e6747f8d301b41ca80e2cd700331708d84b407a0d9d59ef393db184e286449791c506e31e024ce36ac26fb03f9c9ee785d2328783767b5b4835a73bcfb19551adf6f17c11fbcdda4a55ebbfaa11c7899228514b7969be23bd9ab17f1eca6e2bea76e8aa0c20b465e7b254aa7247fca13880c61102c495e217cd853bc9bcd6da098dab46f44246ea942e02c0f63c607f4d0b2a66717188677b605e6964c366cce33c5f63d3b585bf3f2997639dedb7ecd9eb53dcf51e302bb8d547ed8b82338f57095537a6f01adacd0d09f105f44aa752d0c07f15ca8b94d17534e86719512edd337d66c021596c16b543e70171dc1b322f667009ae28ca8a0746d91ffde02f90ee3aac17f5c3bb86df851e15ed40d8b6396c737cf8aa4adf78ad226582e9ded0e24f952399bba7c6f4b7c6682c8d0fb0da5bdea0e3254654a143bea75ff1c9908ac1bdd25d1cf4584aff2e2131189fc619525eaf698c6182770474731bf5d9e9a3d076c004953ab3ebf14e5c82cc6b88eacfba14a60b661a40e024c58fd8bca23f9924e7e94b4a826bd98fd46237f47fbb9ddcb0f2f730c882ff15669ee5130f3629eb79078231e20de87897918acc4b4bf2a9d40da3b9052d9818e651db8a2cfd84f489c61fb7f54d1a701621d2be5cdf8faf942d6948c707fad604ec492b15f6781baff244b28d8e02352815e690a9a7497a9ad74c93aa56fb2c7f5bafb322f18a93c67e13e8ffbb65e735d9e9de152597b52ae6557f0752a6423dd416fd278259cef83feadd1f5082a19eab4c82530b95c0b5884c97e2e4857c6c82247f9872343b0f787b49ef7d148912779a0aba69cbf089bd0a91035f29762b2d9fb7070d12255f64863470ae4e05a88b24ce25291edd131af4cf776470d3d4a01a5e318ecdeebc608a762889f020c063765d8ed5c71c9a6344938029a6a94169b3e5ea7037aed77dcc4285b442aa262d28773b6082a354372a40cb938c064206bc744233f6fec988728a6b59d70a60e2f3130af30f86b91fa936847b89e42decfbdb4b072684f2db17fe77c9c7f112646b96363f5dea8c385ac013ebf767f98ee1c9cc090b1c3020978bbc42ba991a3647889f76ce80b1f6a9cbbd47a8f06a686840e86a5d3da544c1228d1143ab36877b68cee8026f9883d3bb525339eabaefda2ab5d17256e20ef5634d26cc86ee499d56aefee23ee93843065035573487f2a62bf8f515e2e64d799071897e3f636b0655f174818f1e09af65ad1dd0b4889169f4b074be4177cec2bac32f2bd80061b0cb388c6d6ed2e2a6de176b48987fb22d07e750929a79b6589dde8058c8db5a097afe3dcee71864df4eb98a28b5c51c07111a0cd743a7ea71de2bbde1e9890e71455f12ed0aa5d5ef8dcb4c7d9d99389f9553a318f76f05692ba25e0b5e4665e17b97e9e4d676e90bdf8177de2e90f7787bcd602ad7f20e693ccdfb638ff8835a2d14beb2df2ad3d99cb8545ba0ebf5c07486236a5746d0ae9f19d8b7bf123c27c520771af26a0f8d882a88e748977fb2905f4703b161dd356049558961ffa18083d1fe4b0c2d2ea1a0b949524be19efcc0483991a8bcfd2042c1b61d8c0e70d1bb5190aa40c93bcd81e217cbbb137a692ed84a4279ce08e7ceb530bf6e60d514bc00453574c9c466a49f48ac985a24e1483d6dc87de64d2b965b2cf55a0f1abce870b2411c57921362be25501aea26b1447b1ead0f3d76ca1458d595ca74679225621122d34ff451a1fa75a29c30c5fc83596623c3610c2f262f45f29f962c1967c49a8b60a9e03be68c78ca16b1c86d2b2474af9763dce7739e030e31de4640cef0831a04c6ca6c3aee83f5d006115dac21583c60e3f9f94f00291911ffa894f34cf7936f120da40845091fc2dff61ccd2ebbf3e42690e83929e8fa75c0d7461c6c1f799f139899713a04845678d2a6d26351ec54e880c15a42a622eaa690ddf41663afcc0746a8031b33d7d5894137a6052d645dca871c3c87050029000000000067f65f56459696e7daf7768a19fb940ee509847df09a8cc721ebcaaffcc1e761cc98925c6a49fbc5d91f0c2530177fff11624b7f83634fc47a9e08e0e54bc39f236e8bd087cd353ddc354ac438a64f4ce83336b994d00d4d86dd6d8af6a69976fec3548ecc46fe79640ef127ade946d71f13e98ce6e02463bd53aba8ddfb028cc5ee70847a45f48a7939cf17628eb415415e9933bc3facbefa5c3325ddaaceb43a2a685edce8eee5e9e6ee603c5f03b47ef405c263a944ede789a35ed85985fe4cbff9cb0894c8196d94ba0022856be55f35e6d7fe87e3ca5b2ccc644d407f698f2e9d68afc3c908e97d5be79da79fa135f0a8ee27bbac0eee6f2f5c0e0ec69971e5b382b5a5265c88edb4570a679bb46392b6c7602342d1799d562f18452678cb3eb7f4ce3d1f0cdc87d6fc0d8d64b7c66cddf9ee6db5fcbffbb732b388947641056036b9fead7dd54f3acb45792d4cfd88fc840bf977cc24ffe5cfd0b5a8b2983dd6c5fea273370eacf6b80699126f7699af6b35935fd50c7870b04cfe0331fed15765ab94f062d98768047e72c577f45714d2959d19437fcadaca8d042be5db3ee2f39adf020ecb2a82626bd04a65e053912cf9684997c624cc7ad80676b57cec2029371241a8c9cefc4262e78a63458c8dea4e22998fe4d9cfa884175671f7bde1082f3be7c7c4547ccd8d66517e122322ea604232db168d86a0f0bd6a7f9751bed6a91ba0d29ed6a8584409848771b80120a12e4539f4225fef5c8ebd14870a651a184c772b513af898d53b30cc09a932ce587d0a2753848af130e563edf8fd13e32652cb8083dc373e47ff93315418358b141820d6d544cf4e1ca2be95425dde411aa2e051c39b89ffcb65c48ebb1dbbc65f8b699422d95cf379edfbde0709f519b4305838f4189ea1c8cbfe15934a51dac8fa596a01e2674e4f4211e9e67f279ca0cbdaf579ca8e1270dc50131811f776c4a82c89ec38b479090446492834e25e72f7e1ada6b84c7a641ede95c86678060a5b75fefc7577da3d65745052b511082f42ad12c8b3f13137382d97d091f09d47dbfae223f87959785c1a8ba87a82fed34e281cc104eec200f471e8739d142180ee08875b423581b2ca08d0476a830ab56a47b2ceae238174c7741d496ee164a1fc17d3581e9e45d854a5bffaa711e1912186f4a4ae6c2899d08698dea1eb3b9fd361b9efb338464d0e990517089aeb313a74a8c48a9bd9b5b7572128f9243f655d735aef1acaa245f2dd8fcc731289047f97461cf8d56a81dea5c14be503e3876a2c1833ac4b51295c413f1af4800ad976782fba3baeadc77d8e0f71e20332951798fff45f995ec8198ee950eed7f61838df3b36e3f0ba131c73bde2d8a018f1d1cced2516689878684fdd661fcc249bfabe4f86647af54c03dc68a76788a6a548862cdca37d7e36621e09d6b2848b7c4aeac50da55be42ac2c1fadf3aa67b671ce6ef418e7fc6c976a9eed493c64b34c196d256588498683c2d4d5dd554d22d4ef92b8c9d57a799cb386cda2a7610a089c3dc27d4eb2cab29d3b8e31d917224c4fd9d812a4f5de5034f1eea9d77955640a6ff8f980c7d4fd2950abd19283c19767469cb2379f76873ccde2b8d133d8cdc88c494e8b2a0de75bee738ff416a070ea6eacba6ea064fe4cb9ebf5fc92a3652eab0f46aeb9251bc8e965750809423fa4c4d73898aca508512d16d50241ed576695c9b7e5e65c38ca84a070cb5368182cc021592d66aa80efb7ac6d7f155484a0ac106c4b83064767de327b7fa941ff464bf31eeb2c9375decc2e7cf032872803e00f76bb5ee5b8776361bcd284833a9d4d6fec11f65e9700bea2fc298197348ca8ca78d08e4e5a80c71554d9ad0a7aac09247cd32c2fddd8c80036edd8415db60c2df7dcf8fe0c76309fecac7beec9a6ce6d5a12e6388c6b57b32651c64c04de1bea270ed4f5156ecc3bbffbff7845fc70241c519be4758a3dd744123dda661284217eea4eebfdd90154d0df2b53aa4afe0e3332d8af58434b98f4ae1d38c8d024b9837ce83d6d57daa3fab9a69fd970bda632db139a0eac1a59ff23bb1ce98a311d80f634082a7a73bca9190897b48d059766620a357a11c75bd1995b9b619c8e8fbeafc58484ed04760cabb79c074623e6e5115e18da6b698d7a7c2d40b97231ffae09c7947c56d5ea4eb0298400a7f336090ca7e08ea70c725f2c4418013e50ab9ef7c33825c2eeec2cfda89eb4036f0a31026804c35857391217235ca65fa46f6c2c27fc6d94534e78c1583cd9c083d655dfc05f2fed039bb82564409d660798c318658264ac194b6d9e18381a73c224d2136b7c6fa45c056824af3b91a311d5ac65d82fa75a600b3c914512ba08cb5e06f953dbaf84a6b3fc31d923ffd80d7b5cf5fd9b4c83c18d620bc0597892b8476e894b38726f46747b641f1a9a3979b7370ab010b36f57fbec72e552742016e345107cbb44e86d3c8decf1c66040d64412806ff1916895474fe849cc85c04938fe5f14c3c14ec90a629f4f2cbaa2557a959e3669e1b3d0ee8573be5ce58e596a885aaecff5997daafc809d70faa671bb1bff68e0bb13478d3da2946c34d15fa9d905a25427dd7f5c5b42422d4f6013cb45b418af7c918ac2a8bb6912a2f252c35a98bfaddb29c2d03eab588030b9cffa81b4c578c6834ec07e4cb89eeddac5e3bac9670c93234f0574ef354cc4b34e4b055051c5fd36b9b0ef153f29e79ad79eb8d885a5f87f5a96f904d292c8c626b32b0fe75041d0148360782092dabe45679e333e89f69446f7ef3857d537848cdf46437e60a73e9b06607aec55070a5d9608d2ef359ae136ac1e2a5d4b64f85195cd940c6a94563d3e0bb9409c116e4f0986eb3fc834ecf199f55d1102acba89dca5d69c722babf2b3b4192f189d78588855a92845160c0dc0024080a7e7169bea60cc52c93a694616b4051841fdf03dd81d2634e302726f1916894df608b3611e599e8a27313c538bf812de49736346f8ec93dce30ad61f054ed60c1294d4e200cd123d2c04a1141180583f593833efd9072995441fd2f5adfcc264c9dd4e7664eb8df18ccf820f7c031d8de94023bd8f4d6d65251e446fcbd80271e5798c0a33bad0d4e34a5bbdd3585141ac534c9c7c92fb5f074d557bdca8c4c8be08d257187003c5a3261fefb485f760625909a95ef2b1bfee04f344032b1fb67df818e009fbe102968ffafc633d633d17542046689f117fabef3b0a397fd4dd30741ed9abff74867c5c066a6395c5b699a55501e855f10f1ed162206e27d323b952172f8f9315b9eba47e07fa42e79304c80df9d10add8797b197a5d403b5cb8882d43440687d17c65b97c9af015055d3c641ec6f7d6e525b760a36c61b373f98fbc8eddc97230dbe96dbb4a4890d32e1a0ee4f7a5b6bd222c5724c10921dd929ffa9eefbc8600a406767502350813e99ab2cf84f6a8dd2196a4ede6ace554acd4963ff0343661ce1b699170887312514d7cc5f54dc7a8ea01d0d2bfc7ea0e1725623372e215864259a9c15fa196163a688dec601d1e70068c675155493bb4425259744bebf5477ad14ceb433186a499e18cfb798e27186fb05ea91f5780ff5f5dd7ae371687671b18bf3be6ab19077a7fec98677ef3e0e8d1092fe499bfd9afe1e3224582bd451b65d6c6890e914282ac3bfad3852724b54dcdb1a16149032f80d29a3c77507381bedeed5a19d4451dce6d1ddcb3b98355cb34d31bf0c2263028e401e923619e07e0768cdfadf4a5fdd0154514375cf6823baa4abb6f519a51a083cc8a036be350c9c1b990015ba6fd71a2d81fc21fd530cb2c68076bc9e87375d1c4b41edf4b51345bdcac68d9c9ebe30806ceba7104917b7d5ae55ee8353b9f9c9dd1c7709a68351311eac44be0a19b645fc3e47c6ac8408803a12cc7e2b30e50f33a18fd373dfead5e1287211a49458e326921c247995f1749a8c459a4fb32a13036279c764d156b3bdea56b9ac593279f7866cb78dbf1707c0672f7a4e808a45d1f67ba4d1249d00477440fc5ff3f7c7811719ebb266b9916f93b09f821043b3b999195508db4fd94e478941b78728438232d8e4b31746f82845766a84d5fbc08ddd3fb21481531da0c784c2bc1857903864934528c1e027d6e5ce0303a1e420e3e4593fab0c91b29eeeae881e7d18021dc38dce55e6a431ff9cc5e132f2ab5e7dea7939c3aea48c7581d712724d89497bb8b040502b1d8c83e60dbd359a871e6cf40ea4deeff37c8a2753117504a849342888493c7c059d41b0ca2de809b39541c4ae520703eb68b38a93fb17d66ded4eae3f61ecde1eb940bf7dbceefe0847e669f82906203f088d21cd6abf178f7977dfdcf86781ee72a03c9b383c028c699828ded0e"], 0x2dd8}, 0x1, 0x0, 0x0, 0x20040841}, 0x20044) io_setup(0x6, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x3, @any, 0x803}, 0xe) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000000340)={0xffffffffffffffff, r4, 0x8, 0x0, 0x0, 0x3, 0x0, 0x46d, 0xfff9, 0x3, 0x0, 0x8, 'syz0\x00'}) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x119a000, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) socket$inet6(0xa, 0x6, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount(0x0, &(0x7f00000003c0)='./file0\x00', &(0x7f0000000580)='tracefs\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r5 = openat(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x0) getdents64(r5, 0x0, 0xfe0f) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') lseek(r6, 0x9, 0x0) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x7) executing program 4: socket$kcm(0x10, 0x2, 0x10) openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix_mp={0x0, 0x0, 0x34324152, 0x0, 0xa, [{}, {0x10}]}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) mount$bind(&(0x7f0000000300)='./file0\x00', 0x0, 0x0, 0x11080, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8b24, &(0x7f0000000000)={'wlan0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r2 = socket(0x10, 0x803, 0x0) sendto(r2, &(0x7f00000000c0)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x64}, {&(0x7f0000000280)=""/85, 0x55}, {&(0x7f0000000fc0)=""/4096, 0x1000}, {&(0x7f0000000400)=""/106, 0x6a}, {0x0}, {&(0x7f0000000200)=""/77, 0x4d}, {&(0x7f00000007c0)=""/154, 0x9a}, {&(0x7f00000001c0)=""/17, 0x11}], 0x8, &(0x7f0000000600)=""/191, 0xbf}}], 0x1, 0x0, &(0x7f0000003700)={0x77359400}) unshare(0x40000000) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[], 0x48) gettid() executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @local}, 0x14) executing program 1: bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000003c0)=ANY=[@ANYRESOCT], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) inotify_init1(0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000340), 0x0, &(0x7f0000000080)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r3 = creat(&(0x7f00000002c0)='./bus\x00', 0x0) write$binfmt_elf64(r3, &(0x7f0000000100)=ANY=[], 0xfe3c) socket$can_j1939(0x1d, 0x2, 0x7) openat(0xffffffffffffff9c, &(0x7f0000004400)='./bus\x00', 0x6b142, 0x0) ptrace$setregs(0xd, 0x0, 0x0, 0x0) ptrace$poke(0x21, 0x0, 0x0, 0x0) executing program 1: socket$inet6_udp(0xa, 0x2, 0x0) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x2, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000580)={0x58, 0x0, &(0x7f0000000480)=[@decrefs={0x40046307, 0x3}, @reply_sg={0x40486312, {0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x400}, @enter_looper], 0x0, 0x0, &(0x7f0000000540)}) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x5, 0x2, 0x2d9b, 0x7, 0x1, 0xffffffffffffffff, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x4, 0x0, 0x0, @void, @value, @void, @value}, 0x48) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) r3 = signalfd4(0xffffffffffffffff, &(0x7f00000001c0)={[0xffffffffffffffff]}, 0x8, 0x80800) gettid() getpid() read$FUSE(r3, &(0x7f0000001a00)={0x2020}, 0x2020) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$packet(0x11, 0xa, 0x300) recvmmsg(r3, &(0x7f0000007680)=[{{0x0, 0x0, 0x0}}], 0x1, 0x20, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) connect$llc(r4, &(0x7f0000000180)={0x1a, 0x0, 0xfc, 0x8, 0x0, 0x0, @multicast}, 0x10) r5 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$TIOCGPGRP(r5, 0x540f, &(0x7f0000000040)) iopl(0x3) socket$nl_generic(0x10, 0x3, 0x10) r6 = mq_open(&(0x7f000084dff0)='!selinuxselinux\x00', 0x6e93ebbbcc0884f2, 0x0, &(0x7f0000000300)={0x0, 0x1, 0x7}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x3) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000009c0)=@updpolicy={0xc4, 0x19, 0x1, 0x0, 0x25dfdbff, {{@in=@private=0xa010101, @in6=@local, 0x4e22, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80}, {0x0, 0x401, 0xfffffffffffffffe, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x1}, {0x10}}, [@mark={0xc, 0x15, {0x350759, 0x5}}]}, 0xc4}}, 0x1c0) ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(r5, 0x7b2, &(0x7f0000000200)={&(0x7f0000000ac0)=[0x1, 0x8, 0x3, 0xd, 0x3, 0x2, 0x5, 0x81, 0x9, 0xeb7, 0x7, 0x1000, 0x6, 0x651, 0x0, 0x3, 0x3, 0x5, 0x800, 0xf1a, 0x4, 0x5, 0x9, 0x4, 0x4, 0x4, 0x200, 0x1, 0xff, 0x3, 0xe9c, 0x1, 0x8, 0x8a0a, 0xd, 0x100, 0xffffffff, 0x80800, 0x9, 0xffff, 0x4, 0x9, 0x6, 0x5, 0x7, 0x8, 0x7, 0xa, 0x3, 0x9, 0x4, 0x9, 0x1, 0x5, 0x16d6, 0x2, 0x7, 0xda7, 0x0, 0x80000001, 0x1, 0x0, 0x0, 0x9, 0x67a, 0x8, 0x2, 0xfffffffc, 0x0, 0x4e, 0x12, 0x5, 0xf, 0x3, 0x1, 0xe4, 0xffffffff, 0xe97c, 0x6, 0x7, 0x9, 0x9, 0xacc5, 0x0, 0x1, 0x7, 0x5, 0x9, 0x3c41017f, 0x6, 0x3, 0x2, 0x4, 0x7, 0x0, 0xf57a, 0x9, 0x7, 0x2, 0x9, 0x3, 0x3, 0x8, 0xfffff84b, 0x0, 0x4, 0x4000000, 0x4, 0x7, 0x4, 0x401, 0xfffff90c, 0x5, 0x2, 0x2, 0x9, 0xfffffff8, 0x17, 0x7fffffff, 0x8, 0x8, 0xa, 0xbc, 0xbcc, 0x5, 0x8, 0x3, 0x2, 0xa8, 0x1, 0xfff, 0x6, 0xf, 0x0, 0xa24, 0x300, 0x4, 0x6, 0x0, 0x5, 0x3, 0x7, 0x8, 0xcd, 0x80000000, 0x4, 0x2, 0x0, 0x7, 0x10001, 0xfffffff9, 0x80000001, 0x6, 0xffffffff, 0x6, 0x5, 0x8001, 0xa, 0x5, 0x8000, 0x700, 0x9, 0x4, 0x5, 0x77, 0x10001, 0xfff, 0x9, 0x9, 0x7, 0x9, 0x8, 0xfc5, 0x1, 0x4, 0x81, 0x0, 0x2370, 0x8, 0x4, 0x3, 0x1000, 0x4598, 0x5, 0x1, 0x0, 0x8, 0x9, 0xfffffffd, 0x99aa, 0x93, 0x7fff, 0x8, 0xd, 0x3, 0xf, 0xfffffff8, 0x114, 0x4, 0x17a25a09, 0x8, 0x9, 0x4, 0x6, 0xfffffffc, 0x9, 0x5f6, 0x2, 0x101, 0x7f, 0x5, 0x8, 0x5, 0xbcff, 0x0, 0xfffffffb, 0x5, 0x1000, 0x8, 0x3, 0x9, 0x7, 0x7, 0x8, 0x6, 0x5, 0x0, 0x8, 0xc1, 0x9, 0xfff, 0xd, 0x0, 0x80000000, 0x9480000, 0x9, 0x8000, 0x2, 0x7ff, 0x7, 0x91, 0x5, 0xc0000, 0xa3d5, 0x5, 0x0, 0x0, 0x80, 0x8, 0x7fffffff, 0x6adb, 0x10001, 0x7, 0x5, 0xff, 0x5, 0x9, 0x401, 0x8, 0x1, 0x1, 0x229, 0xe, 0x1, 0xd89d, 0xffff0000, 0xfffffff7, 0x7, 0x7, 0xe852, 0x7, 0x5, 0x4, 0x5, 0x9, 0xe3f6, 0x60, 0x24000, 0xa283, 0x7fffffff, 0x1, 0x4, 0x2, 0x800, 0xfff, 0xa29, 0x4, 0x0, 0x8, 0x7, 0xb5, 0x5, 0x1bb, 0x8, 0x9, 0x7, 0x9, 0x8, 0xb, 0x6, 0xffff, 0x5, 0x1, 0x8, 0x9, 0x93a, 0x0, 0x2, 0x6, 0x401, 0x0, 0x6, 0x0, 0x7, 0x8, 0x3ff, 0xfffffffb, 0x9, 0xd202, 0x7f, 0x7f, 0x2, 0x81, 0x3, 0x2, 0x3ff, 0x101, 0x9, 0x48d8, 0x9, 0x8, 0x5, 0x8, 0x4, 0x1, 0x7fffffff, 0x6, 0x5bf6, 0x2, 0xf, 0xa, 0x9, 0x5, 0x54ae2577, 0xffff, 0x6, 0x5063, 0x627e, 0x7, 0x5, 0x80000000, 0x7, 0x8, 0xd, 0x3, 0x7, 0x2, 0x7, 0x5, 0x68, 0x80, 0x4, 0x8, 0x7, 0x438, 0x7fff, 0x9, 0x800, 0x7, 0x5, 0x7fffffff, 0x5, 0x2, 0x4, 0x4, 0x9, 0x7fffffff, 0xe, 0x3, 0x0, 0x5, 0xfffffffa, 0xfff, 0x84c6, 0xffffffff, 0x1, 0x9, 0x8000, 0x2, 0x6, 0x7, 0x10000, 0x4, 0x3ff, 0x5, 0xa, 0xa9, 0x1, 0x400, 0xd98, 0x7, 0x538, 0x0, 0x5, 0x898, 0x6b1, 0x1, 0x9, 0x100, 0x6ca7, 0x1, 0x6, 0x70f6010c, 0xcfd, 0xd16, 0x5, 0x1ff, 0xc2, 0xef, 0x10000, 0x4, 0x5, 0x1, 0x1ff, 0x6, 0x0, 0xfffffffd, 0x9, 0xf0a, 0x40, 0x1, 0x0, 0x4, 0x5, 0x3, 0x800, 0x2, 0x2, 0x9, 0x1, 0x5, 0x4, 0x656, 0xf, 0x6, 0x9, 0x22, 0xfffff90c, 0x0, 0x401, 0x9cd, 0x1, 0x5, 0x1930c85e, 0x5, 0x9, 0x7, 0x5, 0x1, 0xffff, 0xa04, 0xfffffffc, 0x8, 0x4, 0x2, 0x6, 0x6, 0x9, 0x2, 0x9b, 0x7, 0x7, 0x2, 0x0, 0xb, 0x4, 0xb955, 0xa, 0x9, 0x7, 0x6, 0x7, 0x3, 0x2, 0x7, 0x81, 0xed76, 0x100, 0x8, 0x1cdb270b, 0x8, 0xe, 0x9, 0xffffffff, 0x4a, 0x9f, 0x1, 0x7, 0x80, 0x3, 0x7e0, 0x81, 0x9, 0x101, 0xfffff5d0, 0x53, 0xa454, 0x7, 0x8d1, 0xcb25, 0x4, 0x1, 0x2, 0x1, 0x2, 0x40, 0x6, 0x3ff, 0x5, 0x2, 0x3, 0x5, 0x80000001, 0xbec, 0x25, 0xfff, 0x1, 0x5, 0x6, 0x10000, 0xfff, 0x3, 0x2, 0x528f, 0x4, 0x8, 0x7ff, 0x9, 0x0, 0x5, 0x476a, 0x1c, 0x88a, 0x81, 0xcd9, 0x5, 0x0, 0x9, 0x800, 0x0, 0x3, 0x7, 0x1, 0x1000, 0x8, 0x8000, 0x800, 0x1ff, 0x8000, 0x10000, 0x0, 0x6, 0x8, 0x4, 0x6, 0xe, 0x1ffe00, 0x800, 0x6, 0x0, 0x0, 0x5, 0xe6ebc525, 0x3, 0x8, 0xfffffff4, 0x2, 0x3ff, 0x100, 0xa053, 0xec, 0xff, 0xffffffff, 0xfffffffc, 0x10000, 0x1, 0x3, 0x305, 0x4, 0x0, 0xffffffff, 0x29ce, 0x9972, 0x0, 0x0, 0x20000, 0x7, 0xc, 0xfff, 0x5, 0xd, 0x8001, 0x29, 0xfffffffc, 0xb, 0x6, 0xee1, 0x1000, 0x5, 0x1, 0x8, 0x8000, 0x2, 0x0, 0xfffffffb, 0x8, 0x5, 0x10000, 0x55e4384d, 0x3, 0x3, 0x3, 0x0, 0xaec, 0x4, 0xfffffff8, 0x4, 0x10001, 0xa, 0x2, 0x9, 0x9, 0x7, 0x40, 0xfffffffe, 0x303556fb, 0x179, 0x4, 0x0, 0x8c7, 0x900, 0x9, 0xd80, 0x7f, 0xe50, 0x0, 0xfffffffc, 0x5, 0x9, 0x7, 0x50f2, 0x0, 0x7f, 0x2, 0x5, 0x2, 0xffffffc0, 0x2, 0x2, 0x0, 0x6, 0x10001, 0x3, 0x6, 0xc, 0x7f, 0x9, 0x6, 0x6, 0x8, 0x3, 0x2, 0x9, 0x1, 0x2, 0x2, 0x0, 0x6, 0x7fffffff, 0x3, 0x45, 0xb624, 0x5, 0xfffffffb, 0xffffff80, 0x8, 0x10, 0x7, 0x6cd, 0x2, 0x8, 0x6, 0x8, 0xfffffffb, 0x7f, 0x7, 0x10, 0x1000, 0x80000001, 0x81, 0x800, 0x0, 0xffff, 0x0, 0x80000001, 0xc, 0x0, 0x1000, 0x533b, 0xe029, 0x7f, 0xc3, 0x40, 0x1eb6, 0x401, 0x5, 0xfffffffd, 0x3, 0x0, 0x0, 0x2644, 0x8, 0xd, 0x8, 0x1, 0x9, 0x4, 0x0, 0x4, 0x8a53, 0x6, 0x4, 0x50d, 0x7fffffff, 0x101, 0x6, 0x6, 0x0, 0x0, 0x1, 0x5, 0x5, 0x476, 0x7, 0x2, 0x58fe, 0xfff, 0x1, 0x5, 0x80, 0x4, 0x7, 0xf, 0x8001, 0x3, 0x8, 0x3, 0xc228, 0x3, 0x10, 0x950b, 0x40, 0x7, 0x5a4e, 0x7fff, 0x8, 0x4, 0xe3f2, 0x1, 0x2, 0x4, 0x70847928, 0x1, 0x4, 0xfffffff3, 0xffffff00, 0xb00, 0xceea, 0x6, 0xd, 0x1, 0xfffffffe, 0xd27, 0x4, 0x6, 0x9, 0x2, 0x4197, 0xfffff738, 0x101, 0x3, 0xd, 0x6, 0xfffffbff, 0xb3a, 0x7, 0x5, 0x7f, 0x8, 0x8000, 0x5, 0xe55, 0x2119, 0x0, 0xfffffabd, 0x4, 0x1000, 0x7, 0x8, 0x4f5, 0x4, 0xfffffffa, 0x96db, 0x40, 0xa16d, 0xb58b, 0x4, 0x8, 0x7, 0xb5e5, 0x8000, 0x1, 0x97, 0x6, 0x0, 0x5, 0x80, 0x3ff, 0xe, 0x97, 0x4, 0x4, 0x2, 0x400, 0xc2f, 0x2, 0xffff, 0x5, 0x7, 0x4, 0x6, 0x3, 0x0, 0x4, 0x1, 0xffff, 0xffffffff, 0x7, 0x800, 0x40, 0x7, 0x340f, 0x1, 0x6d, 0x9, 0x6, 0x10000, 0x5, 0x0, 0x0, 0xffffff81, 0x10, 0x52bae768, 0x6, 0x4, 0xab, 0x0, 0x5c4ff7e0, 0x200000, 0xbe4, 0xa560, 0xfffffff8, 0x9, 0x8, 0x9, 0x4, 0x3, 0x2, 0x5, 0x0, 0xffffffff, 0x10001, 0x7, 0x0, 0x2, 0x0, 0x1, 0x9, 0x3, 0xe6, 0x357f, 0x7, 0x3800000, 0x20, 0x5, 0x1, 0x10, 0x5, 0x6, 0x3, 0xffffffff, 0x100, 0x8001, 0x4, 0x9, 0x3b2, 0xa76e, 0x80, 0x4, 0x4, 0x7, 0x7, 0x4, 0xf, 0xc, 0x3, 0x7, 0xc1, 0xe, 0x4, 0x7fff, 0x0, 0x6, 0x2cdd, 0x18f, 0x4, 0x8, 0x1, 0x109, 0xffffffff, 0x4, 0x3, 0x0, 0x4, 0x3, 0x0, 0xed0c, 0xffffffff, 0x9, 0x3, 0x6, 0x2, 0x2, 0x1, 0x8, 0x10000, 0x8, 0xffff0f8c, 0x6, 0x3, 0x4, 0xf, 0x4, 0x1, 0x5, 0xb5d, 0x101, 0xffffffba, 0x401, 0x8, 0x1, 0x0, 0x2, 0x653e, 0x1000, 0x1, 0x2, 0x7, 0x5, 0xa, 0x10, 0xc, 0x7890, 0x7, 0x3, 0xc00000, 0xffff0001, 0xcf, 0x3, 0xffff, 0xb038, 0x6b40, 0x1000, 0x100, 0xc, 0x45fe, 0x400000, 0x3f, 0x9, 0x1, 0xc, 0x0, 0x8, 0x10, 0x8, 0x8, 0xaf35, 0x6, 0x9, 0x0, 0x4, 0x4, 0x7, 0xd6, 0xfffffffa, 0x4, 0x9, 0xfffffffc, 0x7f, 0x5d0, 0x1, 0x2, 0x8, 0x94, 0x80, 0xf, 0x1, 0x1ff, 0x4, 0x653, 0x2, 0x3b3eb899, 0x6, 0xfff], 0x2, 0x400, 0x8}) socket$rds(0x15, 0x5, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r9 = io_uring_setup(0x3eae, &(0x7f0000000080)={0x0, 0x0, 0x1281, 0x4}) io_uring_register$IORING_REGISTER_BUFFERS(r9, 0x0, 0x0, 0x0) mq_timedsend(r6, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=@newlink={0x44, 0x10, 0x40d, 0x0, 0x0, {0x0, 0x0, 0x0, r2, 0x2020}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge_slave={{0x11}, {0xc, 0x5, 0x0, 0x1, [@IFLA_BRPORT_MCAST_TO_UCAST={0x5}]}}}]}, 0x44}}, 0x84) executing program 4: syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) socket$nl_netfilter(0x10, 0x3, 0xc) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) add_key(&(0x7f00000002c0)='keyring\x00', &(0x7f0000000300)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) r4 = syz_open_procfs(0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, 0xffffffffffffffff, 0x0) fstat(r4, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000e40)={0x0, 0x0, &(0x7f0000000e00)={&(0x7f0000000040)=@newpolicy={0xb8, 0x13, 0x1, 0x0, 0x0, {{@in=@loopback, @in6=@ipv4={'\x00', '\xff\xff', @multicast2}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x1000, 0x0, 0x0, 0x0, 0x8}, {}, 0x0, 0x0, 0x0, 0x0, 0x2}}, 0xb8}}, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @local}, 0x14) program crashed: KASAN: slab-use-after-free Read in ip6gre_tunnel_xmit single: successfully extracted reproducer found reproducer with 21 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(0xffffffffffffffff, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-socket$pptp-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-connect$bt_l2cap-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_l2cap(r1, 0x0, 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r6, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r3, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r6, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-read$msr-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r2, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-syz_open_dev$MSR-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r2, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program crashed: KASAN: slab-use-after-free Read in ip6gre_tunnel_xmit testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r2, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program crashed: KASAN: slab-use-after-free Read in ip6gre_tunnel_xmit testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setscheduler-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r2, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-prlimit64-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r2, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-prctl$PR_SCHED_CORE-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r2, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program crashed: KASAN: slab-use-after-free Read in ip6gre_tunnel_xmit testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r2, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program crashed: KASAN: slab-use-after-free Read in ip6gre_tunnel_xmit testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(0xffffffffffffffff, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_TIMER_IOCTL_SELECT-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r2, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$sndtimer-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: r0 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r1, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(r0, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r2 = socket$packet(0x11, 0x3, 0x300) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r4, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r5, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r2, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r5, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program crashed: KASAN: slab-use-after-free Read in ip6gre_tunnel_xmit testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x0, 0x0) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, 0x0, &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, 0x0, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB, @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, 0x0, 0x0, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0), 0x0, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet program did not crash simplifying guilty program options testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$SNDRV_TIMER_IOCTL_SELECT-ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER-syz_init_net_socket$bt_l2cap-sched_setscheduler-sched_setaffinity-connect$bt_l2cap-socket$pptp-ioctl$SNDRV_TIMER_IOCTL_SELECT-accept4-socket$packet-socket$nl_route-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_PROG_TEST_RUN-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route-sendto$packet detailed listing: executing program 0: ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, &(0x7f0000000180)={{0x0, 0x2}}) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(0xffffffffffffffff, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0xffffffffffffffff}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) connect$bt_l2cap(r0, 0x0, 0x0) socket$pptp(0x18, 0x1, 0x2) ioctl$SNDRV_TIMER_IOCTL_SELECT(0xffffffffffffffff, 0x40345410, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x3, 0xc, &(0x7f0000000c40)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000002300000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r3, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r4, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe800000000000000000000000000015140007"], 0x68}}, 0x0) sendto$packet(r1, &(0x7f00000003c0)="8ea8a8a120e5f8320c30ce5088a846e947cacb", 0x13, 0x4000, &(0x7f0000000140)={0x11, 0x0, r4, 0x1, 0x0, 0x6, @local}, 0x14) program did not crash reproducing took 1h49m22.574097615s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __vlan_get_protocol include/linux/if_vlan.h:617 [inline] BUG: KASAN: slab-use-after-free in vlan_get_protocol include/linux/if_vlan.h:637 [inline] BUG: KASAN: slab-use-after-free in skb_protocol include/linux/if_vlan.h:668 [inline] BUG: KASAN: slab-use-after-free in ip6gre_tunnel_xmit+0xff7/0x10f0 net/ipv6/ip6_gre.c:919 Read of size 2 at addr ffff8880785424e4 by task syz.2.3270/12772 CPU: 0 UID: 0 PID: 12772 Comm: syz.2.3270 Not tainted 6.12.0-syzkaller-00971-g158f238aa69d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 __vlan_get_protocol include/linux/if_vlan.h:617 [inline] vlan_get_protocol include/linux/if_vlan.h:637 [inline] skb_protocol include/linux/if_vlan.h:668 [inline] ip6gre_tunnel_xmit+0xff7/0x10f0 net/ipv6/ip6_gre.c:919 __netdev_start_xmit include/linux/netdevice.h:4928 [inline] netdev_start_xmit include/linux/netdevice.h:4937 [inline] xmit_one net/core/dev.c:3588 [inline] dev_hard_start_xmit+0x143/0x790 net/core/dev.c:3604 sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:3825 [inline] __dev_queue_xmit+0x136a/0x4350 net/core/dev.c:4398 dev_queue_xmit include/linux/netdevice.h:3094 [inline] packet_xmit+0x23e/0x360 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x2691/0x54d0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] __sys_sendto+0x488/0x4f0 net/socket.c:2195 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f380677e759 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f38075a1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f3806936058 RCX: 00007f380677e759 RDX: 0000000000000013 RSI: 00000000200003c0 RDI: 0000000000000005 RBP: 00007f38067f175e R08: 0000000020000140 R09: 0000000000000014 R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f3806936058 R15: 00007ffdcdbeb018 Allocated by task 12772: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x153/0x310 mm/slub.c:4186 kmalloc_reserve+0x18b/0x2c0 net/core/skbuff.c:587 __alloc_skb+0x164/0x380 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] alloc_skb_with_frags+0xe4/0x850 net/core/skbuff.c:6612 sock_alloc_send_pskb+0x7f1/0x980 net/core/sock.c:2889 packet_alloc_skb net/packet/af_packet.c:2994 [inline] packet_snd net/packet/af_packet.c:3088 [inline] packet_sendmsg+0x1f18/0x54d0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] __sys_sendto+0x488/0x4f0 net/socket.c:2195 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 12772: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kmem_cache_free+0x152/0x4b0 mm/slub.c:4681 skb_kfree_head net/core/skbuff.c:1084 [inline] skb_kfree_head net/core/skbuff.c:1081 [inline] skb_free_head+0x18a/0x1d0 net/core/skbuff.c:1098 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 packet_rcv+0x16c/0x15a0 net/packet/af_packet.c:2290 dev_queue_xmit_nit+0x846/0xba0 net/core/dev.c:2347 xmit_one net/core/dev.c:3584 [inline] dev_hard_start_xmit+0x56/0x790 net/core/dev.c:3604 sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:3825 [inline] __dev_queue_xmit+0x136a/0x4350 net/core/dev.c:4398 dev_queue_xmit include/linux/netdevice.h:3094 [inline] packet_xmit+0x23e/0x360 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x2691/0x54d0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] __sys_sendto+0x488/0x4f0 net/socket.c:2195 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888078542400 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 228 bytes inside of freed 640-byte region [ffff888078542400, ffff888078542680) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78540 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff8881416f6a00 ffffea0000c4c800 dead000000000003 raw: 0000000000000000 0000000080150015 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff8881416f6a00 ffffea0000c4c800 dead000000000003 head: 0000000000000000 0000000080150015 00000001f5000000 0000000000000000 head: 00fff00000000002 ffffea0001e15001 ffffffffffffffff 0000000000000000 head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 76, tgid 76 (kworker/u8:4), ts 97372308770, free_ts 97342937178 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3474 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:2412 [inline] allocate_slab mm/slub.c:2578 [inline] new_slab+0x2c9/0x410 mm/slub.c:2631 ___slab_alloc+0xdac/0x1880 mm/slub.c:3818 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] kmem_cache_alloc_node_noprof+0xed/0x310 mm/slub.c:4186 kmalloc_reserve+0x18b/0x2c0 net/core/skbuff.c:587 __alloc_skb+0x164/0x380 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] nlmsg_new include/net/netlink.h:1015 [inline] inet_netconf_notify_devconf+0x8b/0x1f0 net/ipv4/devinet.c:2142 __devinet_sysctl_unregister net/ipv4/devinet.c:2637 [inline] devinet_sysctl_unregister net/ipv4/devinet.c:2661 [inline] inetdev_destroy net/ipv4/devinet.c:345 [inline] inetdev_event+0xe91/0x1830 net/ipv4/devinet.c:1643 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1996 call_netdevice_notifiers_extack net/core/dev.c:2034 [inline] call_netdevice_notifiers net/core/dev.c:2048 [inline] unregister_netdevice_many_notify+0x8d5/0x1e50 net/core/dev.c:11407 cleanup_net+0x58c/0xb40 net/core/net_namespace.c:621 page last free pid 76 tgid 76 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0x661/0x1080 mm/page_alloc.c:2657 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x153/0x310 mm/slub.c:4186 __alloc_skb+0x2b1/0x380 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1322 [inline] nlmsg_new include/net/netlink.h:1015 [inline] inet_netconf_notify_devconf+0x8b/0x1f0 net/ipv4/devinet.c:2142 __devinet_sysctl_unregister net/ipv4/devinet.c:2637 [inline] devinet_sysctl_unregister net/ipv4/devinet.c:2661 [inline] inetdev_destroy net/ipv4/devinet.c:345 [inline] inetdev_event+0xe91/0x1830 net/ipv4/devinet.c:1643 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1996 call_netdevice_notifiers_extack net/core/dev.c:2034 [inline] call_netdevice_notifiers net/core/dev.c:2048 [inline] unregister_netdevice_many_notify+0x8d5/0x1e50 net/core/dev.c:11407 cleanup_net+0x58c/0xb40 net/core/net_namespace.c:621 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 Memory state around the buggy address: ffff888078542380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888078542400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888078542480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888078542500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888078542580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __vlan_get_protocol include/linux/if_vlan.h:617 [inline] BUG: KASAN: slab-use-after-free in vlan_get_protocol include/linux/if_vlan.h:637 [inline] BUG: KASAN: slab-use-after-free in skb_protocol include/linux/if_vlan.h:668 [inline] BUG: KASAN: slab-use-after-free in ip6gre_tunnel_xmit+0xff7/0x10f0 net/ipv6/ip6_gre.c:919 Read of size 2 at addr ffff8880785424e4 by task syz.2.3270/12772 CPU: 0 UID: 0 PID: 12772 Comm: syz.2.3270 Not tainted 6.12.0-syzkaller-00971-g158f238aa69d #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/30/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0xc3/0x620 mm/kasan/report.c:488 kasan_report+0xd9/0x110 mm/kasan/report.c:601 __vlan_get_protocol include/linux/if_vlan.h:617 [inline] vlan_get_protocol include/linux/if_vlan.h:637 [inline] skb_protocol include/linux/if_vlan.h:668 [inline] ip6gre_tunnel_xmit+0xff7/0x10f0 net/ipv6/ip6_gre.c:919 __netdev_start_xmit include/linux/netdevice.h:4928 [inline] netdev_start_xmit include/linux/netdevice.h:4937 [inline] xmit_one net/core/dev.c:3588 [inline] dev_hard_start_xmit+0x143/0x790 net/core/dev.c:3604 sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:3825 [inline] __dev_queue_xmit+0x136a/0x4350 net/core/dev.c:4398 dev_queue_xmit include/linux/netdevice.h:3094 [inline] packet_xmit+0x23e/0x360 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x2691/0x54d0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] __sys_sendto+0x488/0x4f0 net/socket.c:2195 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f380677e759 Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f38075a1038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c RAX: ffffffffffffffda RBX: 00007f3806936058 RCX: 00007f380677e759 RDX: 0000000000000013 RSI: 00000000200003c0 RDI: 0000000000000005 RBP: 00007f38067f175e R08: 0000000020000140 R09: 0000000000000014 R10: 0000000000004000 R11: 0000000000000246 R12: 0000000000000000 R13: 0000000000000001 R14: 00007f3806936058 R15: 00007ffdcdbeb018 Allocated by task 12772: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 unpoison_slab_object mm/kasan/common.c:319 [inline] __kasan_slab_alloc+0x89/0x90 mm/kasan/common.c:345 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x153/0x310 mm/slub.c:4186 kmalloc_reserve+0x18b/0x2c0 net/core/skbuff.c:587 __alloc_skb+0x164/0x380 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] alloc_skb_with_frags+0xe4/0x850 net/core/skbuff.c:6612 sock_alloc_send_pskb+0x7f1/0x980 net/core/sock.c:2889 packet_alloc_skb net/packet/af_packet.c:2994 [inline] packet_snd net/packet/af_packet.c:3088 [inline] packet_sendmsg+0x1f18/0x54d0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] __sys_sendto+0x488/0x4f0 net/socket.c:2195 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 12772: kasan_save_stack+0x33/0x60 mm/kasan/common.c:47 kasan_save_track+0x14/0x30 mm/kasan/common.c:68 kasan_save_free_info+0x3b/0x60 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x51/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kmem_cache_free+0x152/0x4b0 mm/slub.c:4681 skb_kfree_head net/core/skbuff.c:1084 [inline] skb_kfree_head net/core/skbuff.c:1081 [inline] skb_free_head+0x18a/0x1d0 net/core/skbuff.c:1098 skb_release_data+0x560/0x730 net/core/skbuff.c:1125 skb_release_all net/core/skbuff.c:1190 [inline] __kfree_skb net/core/skbuff.c:1204 [inline] sk_skb_reason_drop+0x129/0x1a0 net/core/skbuff.c:1242 packet_rcv+0x16c/0x15a0 net/packet/af_packet.c:2290 dev_queue_xmit_nit+0x846/0xba0 net/core/dev.c:2347 xmit_one net/core/dev.c:3584 [inline] dev_hard_start_xmit+0x56/0x790 net/core/dev.c:3604 sch_direct_xmit+0x1ae/0xc30 net/sched/sch_generic.c:343 __dev_xmit_skb net/core/dev.c:3825 [inline] __dev_queue_xmit+0x136a/0x4350 net/core/dev.c:4398 dev_queue_xmit include/linux/netdevice.h:3094 [inline] packet_xmit+0x23e/0x360 net/packet/af_packet.c:276 packet_snd net/packet/af_packet.c:3145 [inline] packet_sendmsg+0x2691/0x54d0 net/packet/af_packet.c:3177 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg net/socket.c:726 [inline] __sys_sendto+0x488/0x4f0 net/socket.c:2195 __do_sys_sendto net/socket.c:2202 [inline] __se_sys_sendto net/socket.c:2198 [inline] __x64_sys_sendto+0xe0/0x1c0 net/socket.c:2198 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcd/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888078542400 which belongs to the cache skbuff_small_head of size 640 The buggy address is located 228 bytes inside of freed 640-byte region [ffff888078542400, ffff888078542680) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78540 head: order:2 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 ksm flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff8881416f6a00 ffffea0000c4c800 dead000000000003 raw: 0000000000000000 0000000080150015 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff8881416f6a00 ffffea0000c4c800 dead000000000003 head: 0000000000000000 0000000080150015 00000001f5000000 0000000000000000 head: 00fff00000000002 ffffea0001e15001 ffffffffffffffff 0000000000000000 head: 0000000000000004 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 2, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 76, tgid 76 (kworker/u8:4), ts 97372308770, free_ts 97342937178 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3474 __alloc_pages_noprof+0x223/0x25a0 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2265 alloc_slab_page mm/slub.c:2412 [inline] allocate_slab mm/slub.c:2578 [inline] new_slab+0x2c9/0x410 mm/slub.c:2631 ___slab_alloc+0xdac/0x1880 mm/slub.c:3818 __slab_alloc.constprop.0+0x56/0xb0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] kmem_cache_alloc_node_noprof+0xed/0x310 mm/slub.c:4186 kmalloc_reserve+0x18b/0x2c0 net/core/skbuff.c:587 __alloc_skb+0x164/0x380 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1322 [inline] nlmsg_new include/net/netlink.h:1015 [inline] inet_netconf_notify_devconf+0x8b/0x1f0 net/ipv4/devinet.c:2142 __devinet_sysctl_unregister net/ipv4/devinet.c:2637 [inline] devinet_sysctl_unregister net/ipv4/devinet.c:2661 [inline] inetdev_destroy net/ipv4/devinet.c:345 [inline] inetdev_event+0xe91/0x1830 net/ipv4/devinet.c:1643 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1996 call_netdevice_notifiers_extack net/core/dev.c:2034 [inline] call_netdevice_notifiers net/core/dev.c:2048 [inline] unregister_netdevice_many_notify+0x8d5/0x1e50 net/core/dev.c:11407 cleanup_net+0x58c/0xb40 net/core/net_namespace.c:621 page last free pid 76 tgid 76 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0x661/0x1080 mm/page_alloc.c:2657 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x4e/0x120 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x192/0x1e0 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x69/0x90 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:247 [inline] slab_post_alloc_hook mm/slub.c:4085 [inline] slab_alloc_node mm/slub.c:4134 [inline] kmem_cache_alloc_node_noprof+0x153/0x310 mm/slub.c:4186 __alloc_skb+0x2b1/0x380 net/core/skbuff.c:668 alloc_skb include/linux/skbuff.h:1322 [inline] nlmsg_new include/net/netlink.h:1015 [inline] inet_netconf_notify_devconf+0x8b/0x1f0 net/ipv4/devinet.c:2142 __devinet_sysctl_unregister net/ipv4/devinet.c:2637 [inline] devinet_sysctl_unregister net/ipv4/devinet.c:2661 [inline] inetdev_destroy net/ipv4/devinet.c:345 [inline] inetdev_event+0xe91/0x1830 net/ipv4/devinet.c:1643 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1996 call_netdevice_notifiers_extack net/core/dev.c:2034 [inline] call_netdevice_notifiers net/core/dev.c:2048 [inline] unregister_netdevice_many_notify+0x8d5/0x1e50 net/core/dev.c:11407 cleanup_net+0x58c/0xb40 net/core/net_namespace.c:621 process_one_work+0x9c5/0x1ba0 kernel/workqueue.c:3229 process_scheduled_works kernel/workqueue.c:3310 [inline] worker_thread+0x6c8/0xf00 kernel/workqueue.c:3391 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 Memory state around the buggy address: ffff888078542380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888078542400: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb >ffff888078542480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff888078542500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff888078542580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================