Extracting prog: 7m32.858738645s Minimizing prog: 1h3m52.92038143s Simplifying prog options: 0s Extracting C: 49.260406681s Simplifying C: 16m50.948797897s 30 programs, 3 VMs, timeouts [15s 1m40s 6m0s] extracting reproducer from 30 programs single: executing 5 programs separately with timeout 15s testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x48, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000042ab9c4040200349b5f60102030109023600020000000009040000031699000009050402"], 0x0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init-fanotify_mark-pipe2$9p-openat-mount$9p_fd detailed listing: executing program 0: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r4, 0x5425, 0x0) r5 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r5) ioctl$TCSETSW2(r4, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r2, 0xffffffffffffffff, 0x0) r7 = fanotify_init(0x0, 0x0) fanotify_mark(r7, 0x105, 0x4800003a, r0, 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000100), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r8}}) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io-syz_open_dev$char_usb-syz_usb_disconnect-ioperm-bpf$PROG_LOAD-prctl$PR_SCHED_CORE-sched_setaffinity-openat$hwrng-preadv-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$inet6-bind$inet6-setsockopt$SO_BINDTODEVICE-syz_emit_ethernet-recvfrom-madvise-userfaultfd-socket$isdn-dup3-socket$alg-openat$cgroup_ro-write$cgroup_int-openat$sw_sync-ioctl$SW_SYNC_IOC_CREATE_FENCE-openat$cgroup_ro-mkdir-socket$inet_udplite-setsockopt$IPT_SO_SET_REPLACE detailed listing: executing program 0: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) ioperm(0x0, 0x4, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x15, &(0x7f0000000500)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @ringbuf_output={{}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_fd={0x18, 0x6}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @alu={0x7, 0x1, 0x9, 0xb0af8df7c7d8796b, 0x4, 0x18, 0x4}, @map_fd={0x18, 0x5}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xe, 0x0, 0x0, 0x0, 0x10000}], &(0x7f0000000080)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xe}, 0x90) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000dbff000000004000001d8500000007000000440000002a00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff430486dd601b8b97004d88c19e9ace00000000000000002100000002ff02000000000000000000000000000104004e20004db0"], 0x0) recvfrom(r1, 0x0, 0x45, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) userfaultfd(0x1) socket$isdn(0x22, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mkdir(0x0, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x160, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x7fffffe, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, 'veth1\x00', 'veth0_to_team\x00'}, 0x6, 0x130, 0x160, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "00000100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x7d}}]}, @common=@inet=@SET2={0x30}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-setsockopt$IP6T_SO_SET_REPLACE detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001600)=@mangle={'mangle\x00', 0x8, 0x6, 0x960, 0x770, 0x268, 0xf8, 0xf8, 0x470, 0x890, 0x890, 0x890, 0x890, 0x890, 0x6, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x7a00000000000000}, [@inet=@rpfilter={{0x28}}]}, @HL={0x28}}, {{@ipv6={@dev, @loopback, [], [], 'pimreg0\x00', 'veth1_macvtap\x00'}, 0x0, 0x148, 0x170, 0x0, {0x5002}, [@common=@unspec=@physdev={{0x68}, {'veth0_to_team\x00', {}, 'netpci0\x00', {}, 0x14, 0x15}}, @common=@unspec=@connbytes={{0x38}}]}, @common=@unspec=@NFQUEUE1={0x28}}, {{@uncond, 0x0, 0x1e0, 0x208, 0x0, {}, [@common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, @local, @local, @local, @dev, @rand_addr=' \x01\x00', @private1, @mcast2, @dev, @private2, @private1, @mcast2, @loopback]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@eui64={{0x28}}]}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x9c0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$FS_IOC_GETVERSION-socket$inet_udp-bind$inet-setsockopt$inet_group_source_req-getsockopt$inet_buf-getsockopt$inet_mreqn-ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL-setsockopt$sock_int-socket$inet-mmap-setsockopt$inet_MCAST_JOIN_GROUP-accept4$inet6-connect$inet-socket$packet-setsockopt$inet_udp_encap-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX-bind$packet-setsockopt$packet_add_memb-socketpair$unix-setsockopt$SO_ATTACH_FILTER-sendmsg$inet-ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD-socket$packet-setsockopt$packet_fanout-socket$packet-setsockopt$packet_fanout-recvfrom$packet-mmap-bpf$PROG_LOAD detailed listing: executing program 0: ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80047601, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000480)={0x1, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @private}}}, 0x108) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000340)=""/219, &(0x7f0000000140)=0xdb) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000600)={@broadcast, @initdev}, &(0x7f00000005c0)=0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000740)={'syztnl2\x00', &(0x7f0000000ac0)}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000300)=0x2f, 0x4) r1 = socket$inet(0x2, 0x6000000000000001, 0x0) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x2000001, 0x2011, r1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000a00)={0x3, {{0x2, 0x4e22, @empty}}}, 0x88) accept4$inet6(0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)=0x1c, 0x80000) connect$inet(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x0, @multicast1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'vlan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x4, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}}, 0x14) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r3, 0x1, 0x6, @local}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0x1}, {0x6}]}, 0x10) sendmsg$inet(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000080)="b1970eab", 0x4}], 0x1}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r2, 0x8982, &(0x7f0000000040)={0x1, 'vlan0\x00', {}, 0x6}) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000240)={0x4, 0x1}, 0x4) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000380)={0x4, 0x8000}, 0x4) recvfrom$packet(0xffffffffffffffff, &(0x7f00000000c0)=""/50, 0x32, 0x2101, &(0x7f0000000100)={0x11, 0x11, 0x0, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) mmap(&(0x7f000009b000/0x4000)=nil, 0x4000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x7, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="bc0000c6cac374007d00000000006910a80000000000180000030000000000000038ac01bc00090000006ae0837588a040619500000c00000000cde93770c01bb3cfacdb8cc8e200b9e1fe9f17d3c79e7ac0a04eddab98066bbfbecdf9a0b26309ff622185068355093ab1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f0000000640)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x80) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 15s testing program (duration=22s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 2, 29, 30, 2, 29, 30, 2, 29, 30, 2, 29, 30, 2, 29, 30, 2, 29, 24, 30, 3, 2, 6, 15, 29, 2, 4, 23, 4, 1] detailed listing: executing program 3: ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80047601, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000480)={0x1, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @private}}}, 0x108) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000340)=""/219, &(0x7f0000000140)=0xdb) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000600)={@broadcast, @initdev}, &(0x7f00000005c0)=0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000740)={'syztnl2\x00', &(0x7f0000000ac0)}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000300)=0x2f, 0x4) r1 = socket$inet(0x2, 0x6000000000000001, 0x0) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x2000001, 0x2011, r1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000a00)={0x3, {{0x2, 0x4e22, @empty}}}, 0x88) accept4$inet6(0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)=0x1c, 0x80000) connect$inet(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x0, @multicast1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'vlan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x4, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}}, 0x14) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r3, 0x1, 0x6, @local}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0x1}, {0x6}]}, 0x10) sendmsg$inet(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000080)="b1970eab", 0x4}], 0x1}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r2, 0x8982, &(0x7f0000000040)={0x1, 'vlan0\x00', {}, 0x6}) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000240)={0x4, 0x1}, 0x4) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000380)={0x4, 0x8000}, 0x4) recvfrom$packet(0xffffffffffffffff, &(0x7f00000000c0)=""/50, 0x32, 0x2101, &(0x7f0000000100)={0x11, 0x11, 0x0, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) mmap(&(0x7f000009b000/0x4000)=nil, 0x4000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x7, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="bc0000c6cac374007d00000000006910a80000000000180000030000000000000038ac01bc00090000006ae0837588a040619500000c00000000cde93770c01bb3cfacdb8cc8e200b9e1fe9f17d3c79e7ac0a04eddab98066bbfbecdf9a0b26309ff622185068355093ab1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f0000000640)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x80) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001600)=@mangle={'mangle\x00', 0x8, 0x6, 0x960, 0x770, 0x268, 0xf8, 0xf8, 0x470, 0x890, 0x890, 0x890, 0x890, 0x890, 0x6, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x7a00000000000000}, [@inet=@rpfilter={{0x28}}]}, @HL={0x28}}, {{@ipv6={@dev, @loopback, [], [], 'pimreg0\x00', 'veth1_macvtap\x00'}, 0x0, 0x148, 0x170, 0x0, {0x5002}, [@common=@unspec=@physdev={{0x68}, {'veth0_to_team\x00', {}, 'netpci0\x00', {}, 0x14, 0x15}}, @common=@unspec=@connbytes={{0x38}}]}, @common=@unspec=@NFQUEUE1={0x28}}, {{@uncond, 0x0, 0x1e0, 0x208, 0x0, {}, [@common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, @local, @local, @local, @dev, @rand_addr=' \x01\x00', @private1, @mcast2, @dev, @private2, @private1, @mcast2, @loopback]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@eui64={{0x28}}]}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x9c0) executing program 4: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) ioperm(0x0, 0x4, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x15, &(0x7f0000000500)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @ringbuf_output={{}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_fd={0x18, 0x6}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @alu={0x7, 0x1, 0x9, 0xb0af8df7c7d8796b, 0x4, 0x18, 0x4}, @map_fd={0x18, 0x5}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xe, 0x0, 0x0, 0x0, 0x10000}], &(0x7f0000000080)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xe}, 0x90) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000dbff000000004000001d8500000007000000440000002a00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff430486dd601b8b97004d88c19e9ace00000000000000002100000002ff02000000000000000000000000000104004e20004db0"], 0x0) recvfrom(r1, 0x0, 0x45, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) userfaultfd(0x1) socket$isdn(0x22, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mkdir(0x0, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x160, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x7fffffe, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, 'veth1\x00', 'veth0_to_team\x00'}, 0x6, 0x130, 0x160, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "00000100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x7d}}]}, @common=@inet=@SET2={0x30}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) executing program 3: ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80047601, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000480)={0x1, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @private}}}, 0x108) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000340)=""/219, &(0x7f0000000140)=0xdb) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000600)={@broadcast, @initdev}, &(0x7f00000005c0)=0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000740)={'syztnl2\x00', &(0x7f0000000ac0)}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000300)=0x2f, 0x4) r1 = socket$inet(0x2, 0x6000000000000001, 0x0) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x2000001, 0x2011, r1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000a00)={0x3, {{0x2, 0x4e22, @empty}}}, 0x88) accept4$inet6(0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)=0x1c, 0x80000) connect$inet(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x0, @multicast1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'vlan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x4, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}}, 0x14) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r3, 0x1, 0x6, @local}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0x1}, {0x6}]}, 0x10) sendmsg$inet(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000080)="b1970eab", 0x4}], 0x1}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r2, 0x8982, &(0x7f0000000040)={0x1, 'vlan0\x00', {}, 0x6}) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000240)={0x4, 0x1}, 0x4) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000380)={0x4, 0x8000}, 0x4) recvfrom$packet(0xffffffffffffffff, &(0x7f00000000c0)=""/50, 0x32, 0x2101, &(0x7f0000000100)={0x11, 0x11, 0x0, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) mmap(&(0x7f000009b000/0x4000)=nil, 0x4000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x7, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="bc0000c6cac374007d00000000006910a80000000000180000030000000000000038ac01bc00090000006ae0837588a040619500000c00000000cde93770c01bb3cfacdb8cc8e200b9e1fe9f17d3c79e7ac0a04eddab98066bbfbecdf9a0b26309ff622185068355093ab1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f0000000640)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x80) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001600)=@mangle={'mangle\x00', 0x8, 0x6, 0x960, 0x770, 0x268, 0xf8, 0xf8, 0x470, 0x890, 0x890, 0x890, 0x890, 0x890, 0x6, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x7a00000000000000}, [@inet=@rpfilter={{0x28}}]}, @HL={0x28}}, {{@ipv6={@dev, @loopback, [], [], 'pimreg0\x00', 'veth1_macvtap\x00'}, 0x0, 0x148, 0x170, 0x0, {0x5002}, [@common=@unspec=@physdev={{0x68}, {'veth0_to_team\x00', {}, 'netpci0\x00', {}, 0x14, 0x15}}, @common=@unspec=@connbytes={{0x38}}]}, @common=@unspec=@NFQUEUE1={0x28}}, {{@uncond, 0x0, 0x1e0, 0x208, 0x0, {}, [@common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, @local, @local, @local, @dev, @rand_addr=' \x01\x00', @private1, @mcast2, @dev, @private2, @private1, @mcast2, @loopback]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@eui64={{0x28}}]}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x9c0) executing program 4: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) ioperm(0x0, 0x4, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x15, &(0x7f0000000500)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @ringbuf_output={{}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_fd={0x18, 0x6}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @alu={0x7, 0x1, 0x9, 0xb0af8df7c7d8796b, 0x4, 0x18, 0x4}, @map_fd={0x18, 0x5}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xe, 0x0, 0x0, 0x0, 0x10000}], &(0x7f0000000080)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xe}, 0x90) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000dbff000000004000001d8500000007000000440000002a00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff430486dd601b8b97004d88c19e9ace00000000000000002100000002ff02000000000000000000000000000104004e20004db0"], 0x0) recvfrom(r1, 0x0, 0x45, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) userfaultfd(0x1) socket$isdn(0x22, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mkdir(0x0, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x160, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x7fffffe, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, 'veth1\x00', 'veth0_to_team\x00'}, 0x6, 0x130, 0x160, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "00000100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x7d}}]}, @common=@inet=@SET2={0x30}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) executing program 3: ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80047601, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000480)={0x1, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @private}}}, 0x108) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000340)=""/219, &(0x7f0000000140)=0xdb) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000600)={@broadcast, @initdev}, &(0x7f00000005c0)=0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000740)={'syztnl2\x00', &(0x7f0000000ac0)}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000300)=0x2f, 0x4) r1 = socket$inet(0x2, 0x6000000000000001, 0x0) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x2000001, 0x2011, r1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000a00)={0x3, {{0x2, 0x4e22, @empty}}}, 0x88) accept4$inet6(0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)=0x1c, 0x80000) connect$inet(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x0, @multicast1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'vlan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x4, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}}, 0x14) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r3, 0x1, 0x6, @local}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0x1}, {0x6}]}, 0x10) sendmsg$inet(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000080)="b1970eab", 0x4}], 0x1}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r2, 0x8982, &(0x7f0000000040)={0x1, 'vlan0\x00', {}, 0x6}) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000240)={0x4, 0x1}, 0x4) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000380)={0x4, 0x8000}, 0x4) recvfrom$packet(0xffffffffffffffff, &(0x7f00000000c0)=""/50, 0x32, 0x2101, &(0x7f0000000100)={0x11, 0x11, 0x0, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) mmap(&(0x7f000009b000/0x4000)=nil, 0x4000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x7, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="bc0000c6cac374007d00000000006910a80000000000180000030000000000000038ac01bc00090000006ae0837588a040619500000c00000000cde93770c01bb3cfacdb8cc8e200b9e1fe9f17d3c79e7ac0a04eddab98066bbfbecdf9a0b26309ff622185068355093ab1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f0000000640)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x80) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001600)=@mangle={'mangle\x00', 0x8, 0x6, 0x960, 0x770, 0x268, 0xf8, 0xf8, 0x470, 0x890, 0x890, 0x890, 0x890, 0x890, 0x6, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x7a00000000000000}, [@inet=@rpfilter={{0x28}}]}, @HL={0x28}}, {{@ipv6={@dev, @loopback, [], [], 'pimreg0\x00', 'veth1_macvtap\x00'}, 0x0, 0x148, 0x170, 0x0, {0x5002}, [@common=@unspec=@physdev={{0x68}, {'veth0_to_team\x00', {}, 'netpci0\x00', {}, 0x14, 0x15}}, @common=@unspec=@connbytes={{0x38}}]}, @common=@unspec=@NFQUEUE1={0x28}}, {{@uncond, 0x0, 0x1e0, 0x208, 0x0, {}, [@common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, @local, @local, @local, @dev, @rand_addr=' \x01\x00', @private1, @mcast2, @dev, @private2, @private1, @mcast2, @loopback]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@eui64={{0x28}}]}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x9c0) executing program 4: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) ioperm(0x0, 0x4, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x15, &(0x7f0000000500)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @ringbuf_output={{}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_fd={0x18, 0x6}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @alu={0x7, 0x1, 0x9, 0xb0af8df7c7d8796b, 0x4, 0x18, 0x4}, @map_fd={0x18, 0x5}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xe, 0x0, 0x0, 0x0, 0x10000}], &(0x7f0000000080)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xe}, 0x90) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000dbff000000004000001d8500000007000000440000002a00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff430486dd601b8b97004d88c19e9ace00000000000000002100000002ff02000000000000000000000000000104004e20004db0"], 0x0) recvfrom(r1, 0x0, 0x45, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) userfaultfd(0x1) socket$isdn(0x22, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mkdir(0x0, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x160, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x7fffffe, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, 'veth1\x00', 'veth0_to_team\x00'}, 0x6, 0x130, 0x160, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "00000100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x7d}}]}, @common=@inet=@SET2={0x30}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) executing program 3: ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80047601, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000480)={0x1, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @private}}}, 0x108) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000340)=""/219, &(0x7f0000000140)=0xdb) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000600)={@broadcast, @initdev}, &(0x7f00000005c0)=0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000740)={'syztnl2\x00', &(0x7f0000000ac0)}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000300)=0x2f, 0x4) r1 = socket$inet(0x2, 0x6000000000000001, 0x0) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x2000001, 0x2011, r1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000a00)={0x3, {{0x2, 0x4e22, @empty}}}, 0x88) accept4$inet6(0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)=0x1c, 0x80000) connect$inet(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x0, @multicast1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'vlan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x4, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}}, 0x14) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r3, 0x1, 0x6, @local}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0x1}, {0x6}]}, 0x10) sendmsg$inet(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000080)="b1970eab", 0x4}], 0x1}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r2, 0x8982, &(0x7f0000000040)={0x1, 'vlan0\x00', {}, 0x6}) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000240)={0x4, 0x1}, 0x4) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000380)={0x4, 0x8000}, 0x4) recvfrom$packet(0xffffffffffffffff, &(0x7f00000000c0)=""/50, 0x32, 0x2101, &(0x7f0000000100)={0x11, 0x11, 0x0, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) mmap(&(0x7f000009b000/0x4000)=nil, 0x4000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x7, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="bc0000c6cac374007d00000000006910a80000000000180000030000000000000038ac01bc00090000006ae0837588a040619500000c00000000cde93770c01bb3cfacdb8cc8e200b9e1fe9f17d3c79e7ac0a04eddab98066bbfbecdf9a0b26309ff622185068355093ab1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f0000000640)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x80) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001600)=@mangle={'mangle\x00', 0x8, 0x6, 0x960, 0x770, 0x268, 0xf8, 0xf8, 0x470, 0x890, 0x890, 0x890, 0x890, 0x890, 0x6, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x7a00000000000000}, [@inet=@rpfilter={{0x28}}]}, @HL={0x28}}, {{@ipv6={@dev, @loopback, [], [], 'pimreg0\x00', 'veth1_macvtap\x00'}, 0x0, 0x148, 0x170, 0x0, {0x5002}, [@common=@unspec=@physdev={{0x68}, {'veth0_to_team\x00', {}, 'netpci0\x00', {}, 0x14, 0x15}}, @common=@unspec=@connbytes={{0x38}}]}, @common=@unspec=@NFQUEUE1={0x28}}, {{@uncond, 0x0, 0x1e0, 0x208, 0x0, {}, [@common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, @local, @local, @local, @dev, @rand_addr=' \x01\x00', @private1, @mcast2, @dev, @private2, @private1, @mcast2, @loopback]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@eui64={{0x28}}]}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x9c0) executing program 4: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) ioperm(0x0, 0x4, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x15, &(0x7f0000000500)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @ringbuf_output={{}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_fd={0x18, 0x6}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @alu={0x7, 0x1, 0x9, 0xb0af8df7c7d8796b, 0x4, 0x18, 0x4}, @map_fd={0x18, 0x5}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xe, 0x0, 0x0, 0x0, 0x10000}], &(0x7f0000000080)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xe}, 0x90) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000dbff000000004000001d8500000007000000440000002a00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff430486dd601b8b97004d88c19e9ace00000000000000002100000002ff02000000000000000000000000000104004e20004db0"], 0x0) recvfrom(r1, 0x0, 0x45, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) userfaultfd(0x1) socket$isdn(0x22, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mkdir(0x0, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x160, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x7fffffe, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, 'veth1\x00', 'veth0_to_team\x00'}, 0x6, 0x130, 0x160, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "00000100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x7d}}]}, @common=@inet=@SET2={0x30}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) executing program 3: ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80047601, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000480)={0x1, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @private}}}, 0x108) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000340)=""/219, &(0x7f0000000140)=0xdb) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000600)={@broadcast, @initdev}, &(0x7f00000005c0)=0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000740)={'syztnl2\x00', &(0x7f0000000ac0)}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000300)=0x2f, 0x4) r1 = socket$inet(0x2, 0x6000000000000001, 0x0) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x2000001, 0x2011, r1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000a00)={0x3, {{0x2, 0x4e22, @empty}}}, 0x88) accept4$inet6(0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)=0x1c, 0x80000) connect$inet(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x0, @multicast1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'vlan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x4, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}}, 0x14) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r3, 0x1, 0x6, @local}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0x1}, {0x6}]}, 0x10) sendmsg$inet(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000080)="b1970eab", 0x4}], 0x1}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r2, 0x8982, &(0x7f0000000040)={0x1, 'vlan0\x00', {}, 0x6}) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000240)={0x4, 0x1}, 0x4) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000380)={0x4, 0x8000}, 0x4) recvfrom$packet(0xffffffffffffffff, &(0x7f00000000c0)=""/50, 0x32, 0x2101, &(0x7f0000000100)={0x11, 0x11, 0x0, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) mmap(&(0x7f000009b000/0x4000)=nil, 0x4000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x7, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="bc0000c6cac374007d00000000006910a80000000000180000030000000000000038ac01bc00090000006ae0837588a040619500000c00000000cde93770c01bb3cfacdb8cc8e200b9e1fe9f17d3c79e7ac0a04eddab98066bbfbecdf9a0b26309ff622185068355093ab1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f0000000640)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x80) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001600)=@mangle={'mangle\x00', 0x8, 0x6, 0x960, 0x770, 0x268, 0xf8, 0xf8, 0x470, 0x890, 0x890, 0x890, 0x890, 0x890, 0x6, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x7a00000000000000}, [@inet=@rpfilter={{0x28}}]}, @HL={0x28}}, {{@ipv6={@dev, @loopback, [], [], 'pimreg0\x00', 'veth1_macvtap\x00'}, 0x0, 0x148, 0x170, 0x0, {0x5002}, [@common=@unspec=@physdev={{0x68}, {'veth0_to_team\x00', {}, 'netpci0\x00', {}, 0x14, 0x15}}, @common=@unspec=@connbytes={{0x38}}]}, @common=@unspec=@NFQUEUE1={0x28}}, {{@uncond, 0x0, 0x1e0, 0x208, 0x0, {}, [@common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, @local, @local, @local, @dev, @rand_addr=' \x01\x00', @private1, @mcast2, @dev, @private2, @private1, @mcast2, @loopback]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@eui64={{0x28}}]}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x9c0) executing program 4: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) ioperm(0x0, 0x4, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x15, &(0x7f0000000500)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @ringbuf_output={{}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_fd={0x18, 0x6}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @alu={0x7, 0x1, 0x9, 0xb0af8df7c7d8796b, 0x4, 0x18, 0x4}, @map_fd={0x18, 0x5}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xe, 0x0, 0x0, 0x0, 0x10000}], &(0x7f0000000080)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xe}, 0x90) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000dbff000000004000001d8500000007000000440000002a00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff430486dd601b8b97004d88c19e9ace00000000000000002100000002ff02000000000000000000000000000104004e20004db0"], 0x0) recvfrom(r1, 0x0, 0x45, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) userfaultfd(0x1) socket$isdn(0x22, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mkdir(0x0, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x160, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x7fffffe, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, 'veth1\x00', 'veth0_to_team\x00'}, 0x6, 0x130, 0x160, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "00000100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x7d}}]}, @common=@inet=@SET2={0x30}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) executing program 3: ioctl$FS_IOC_GETVERSION(0xffffffffffffffff, 0x80047601, &(0x7f0000000000)) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000140)={0x2, 0x0, @local}, 0x10) setsockopt$inet_group_source_req(0xffffffffffffffff, 0x0, 0x2e, &(0x7f0000000480)={0x1, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @private}}}, 0x108) getsockopt$inet_buf(0xffffffffffffffff, 0x0, 0x30, &(0x7f0000000340)=""/219, &(0x7f0000000140)=0xdb) getsockopt$inet_mreqn(r0, 0x0, 0x0, &(0x7f0000000600)={@broadcast, @initdev}, &(0x7f00000005c0)=0xc) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000740)={'syztnl2\x00', &(0x7f0000000ac0)}) setsockopt$sock_int(r0, 0x1, 0x6, &(0x7f0000000300)=0x2f, 0x4) r1 = socket$inet(0x2, 0x6000000000000001, 0x0) mmap(&(0x7f0000001000/0x200000)=nil, 0x200000, 0x2000001, 0x2011, r1, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r0, 0x0, 0x2a, &(0x7f0000000a00)={0x3, {{0x2, 0x4e22, @empty}}}, 0x88) accept4$inet6(0xffffffffffffffff, &(0x7f0000000180), &(0x7f00000001c0)=0x1c, 0x80000) connect$inet(0xffffffffffffffff, &(0x7f0000000400)={0x2, 0x0, @multicast1}, 0x10) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$inet_udp_encap(r0, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000340)={'wg1\x00'}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000280)={'vlan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000040)={0x11, 0x0, r3, 0x1, 0x4, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x15}}, 0x14) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f00000002c0)={r3, 0x1, 0x6, @local}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000440)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r5, 0x1, 0x1a, &(0x7f00000001c0)={0x3, &(0x7f0000000040)=[{0x20, 0x0, 0x0, 0xfffff00c}, {0x20, 0x0, 0x0, 0x1}, {0x6}]}, 0x10) sendmsg$inet(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000080)="b1970eab", 0x4}], 0x1}, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r2, 0x8982, &(0x7f0000000040)={0x1, 'vlan0\x00', {}, 0x6}) socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r2, 0x107, 0x12, &(0x7f0000000240)={0x4, 0x1}, 0x4) r6 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r6, 0x107, 0x12, &(0x7f0000000380)={0x4, 0x8000}, 0x4) recvfrom$packet(0xffffffffffffffff, &(0x7f00000000c0)=""/50, 0x32, 0x2101, &(0x7f0000000100)={0x11, 0x11, 0x0, 0x1, 0x2, 0x6, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x14) mmap(&(0x7f000009b000/0x4000)=nil, 0x4000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x7, 0x5, &(0x7f0000000800)=ANY=[@ANYBLOB="bc0000c6cac374007d00000000006910a80000000000180000030000000000000038ac01bc00090000006ae0837588a040619500000c00000000cde93770c01bb3cfacdb8cc8e200b9e1fe9f17d3c79e7ac0a04eddab98066bbfbecdf9a0b26309ff622185068355093ab1"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xc3, &(0x7f0000000640)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x80) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000001600)=@mangle={'mangle\x00', 0x8, 0x6, 0x960, 0x770, 0x268, 0xf8, 0xf8, 0x470, 0x890, 0x890, 0x890, 0x890, 0x890, 0x6, 0x0, {[{{@uncond, 0x0, 0xd0, 0xf8, 0x0, {0x7a00000000000000}, [@inet=@rpfilter={{0x28}}]}, @HL={0x28}}, {{@ipv6={@dev, @loopback, [], [], 'pimreg0\x00', 'veth1_macvtap\x00'}, 0x0, 0x148, 0x170, 0x0, {0x5002}, [@common=@unspec=@physdev={{0x68}, {'veth0_to_team\x00', {}, 'netpci0\x00', {}, 0x14, 0x15}}, @common=@unspec=@connbytes={{0x38}}]}, @common=@unspec=@NFQUEUE1={0x28}}, {{@uncond, 0x0, 0x1e0, 0x208, 0x0, {}, [@common=@rt={{0x138}, {0x0, [], 0x0, 0x0, 0x0, [@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', @remote, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, @local, @local, @local, @dev, @rand_addr=' \x01\x00', @private1, @mcast2, @dev, @private2, @private1, @mcast2, @loopback]}}]}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0x2d8, 0x300, 0x0, {}, [@common=@unspec=@bpf0={{0x230}}]}, @common=@unspec=@MARK={0x28}}, {{@uncond, 0x0, 0xf8, 0x120, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@eui64={{0x28}}]}, @inet=@TOS={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x9c0) executing program 4: syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(0xffffffffffffffff) ioperm(0x0, 0x4, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x15, &(0x7f0000000500)=@raw=[@ringbuf_query={{0x18, 0x1, 0x1, 0x0, 0x1}}, @ringbuf_output={{}, {}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @map_fd={0x18, 0x6}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @alu={0x7, 0x1, 0x9, 0xb0af8df7c7d8796b, 0x4, 0x18, 0x4}, @map_fd={0x18, 0x5}, @map_idx_val={0x18, 0x4, 0x6, 0x0, 0xe, 0x0, 0x0, 0x0, 0x10000}], &(0x7f0000000080)='GPL\x00', 0x8, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0xe}, 0x90) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="180000000000dbff000000004000001d8500000007000000440000002a00000095"], &(0x7f0000000400)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$inet6(0xa, 0x80002, 0x88) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x10000000004e20, 0x0, @mcast2, 0x6}, 0x1c) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) syz_emit_ethernet(0x83, &(0x7f0000000800)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff430486dd601b8b97004d88c19e9ace00000000000000002100000002ff02000000000000000000000000000104004e20004db0"], 0x0) recvfrom(r1, 0x0, 0x45, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) userfaultfd(0x1) socket$isdn(0x22, 0x2, 0x0) dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(0xffffffffffffffff, 0x0, 0x0) r2 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x100, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) mkdir(0x0, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x2c8, 0x0, 0xffffffff, 0xffffffff, 0x160, 0xffffffff, 0x230, 0xffffffff, 0xffffffff, 0x230, 0xffffffff, 0x7fffffe, 0x0, {[{{@ip={@broadcast, @loopback, 0x0, 0x0, 'veth1\x00', 'veth0_to_team\x00'}, 0x6, 0x130, 0x160, 0x0, {}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "00000100cbd047da9ca965f96ad5801f0514d363ee84bb895919d9490f6785fba3c4a44f1e25ecefef2a2d6054f5260ece5ce1a56a5ef73be11d65bfe8c37674024c183ebacdf741cea92ded3a9ca54de15dd9ec8ef62f9e000000000000000000ffffff7f00", 0x7d}}]}, @common=@inet=@SET2={0x30}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) executing program 0: r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) r1 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r1, 0x114, 0x8, &(0x7f0000000040)=0xffffffffffffffff, 0x4) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x40000000000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r5}, 0x10) bind$alg(0xffffffffffffffff, 0x0, 0x0) r6 = syz_init_net_socket$nfc_llcp(0x27, 0x0, 0x1) syz_pidfd_open(r2, 0x0) bind$bt_hci(r6, &(0x7f0000000000)={0x27}, 0x74) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) bind$inet6(0xffffffffffffffff, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="300000001000070100dd2120010000", @ANYRES32=0x0, @ANYBLOB="000000000080000008001b000000000005001000"], 0x30}}, 0x0) sendmmsg$inet(r0, &(0x7f0000003b00)=[{{&(0x7f0000000040)={0x2, 0x0, @empty}, 0x10, 0x0}}, {{&(0x7f0000000000)={0x2, 0x0, @empty}, 0x10, &(0x7f00000002c0)=[{&(0x7f0000002940)="2e7be370f88e801dcbfd6fc9b169aadf2d788f31060000002c9c1ea0d17dc8387758e4428f3e298ab317415fd80b0cf47466f42c8884034bfe4e7ea097451bdc05d7b582537e4ab091cd008a8000000000000000368d5e9e19a9d33882be8e62fd0bbfcc94c842aa81c9", 0x6a}], 0x1}}], 0x2, 0x814) executing program 0: syz_emit_ethernet(0x36, &(0x7f0000000840)=ANY=[@ANYBLOB="0180c200000006673c8d892482a8daaaaaaaaaaa20080045000028000000000002907800000000ffffffff11e09077ffec000062ea00f65934fab8d35b076087408a991391578e7acf331af66d9f91bea95245318ae773c05a3e762ac2411fe0623ca856d1486f1049e99d89c680a5dd27ec5b6402664a7af8f92cc26d9ea0ef"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0xffffffffffffffca, &(0x7f0000000040)=0x10001) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = fanotify_init(0x0, 0x0) socket$can_j1939(0x1d, 0x2, 0x7) r2 = creat(0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) madvise(&(0x7f00003c3000/0x4000)=nil, 0x4000, 0xb) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x3, 0x0, r2, 0x0, '\x00', 0x0, 0x0, 0x4}, 0x48) io_setup(0x0, &(0x7f0000000000)) r4 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000100)={0x3, "420600753785259249154c944122ad063ff47d3bd7a8a45d6bb4c78a0400"}) io_submit(0x0, 0x4, &(0x7f0000000580)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, 0xffffffffffffffff, 0x0}, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0x4, r4, &(0x7f0000000400)="2533084602303ffb533cebabd138b5af71859350822f671e0862ac832c88a579636d00057bc86e3dee7cdec182d15af971d7457743e691b19c1ecdf008fe6a2df2a47ec1af43c011b2a23b5b9e981f6e0d9bf2df5b55e07b4932a011b23910c5a181bde83f243c237ce9dc48b51060c78994075a75351f32519fcc581abe33772184c80ed2cd102043ed8dc5db0cac50120dce3af8f0be856d63e287f93112a11f047aff614b6e197eae222da003b3060ba7", 0xb2, 0x4, 0x0, 0x1}, &(0x7f0000000380)={0x0, 0x0, 0x0, 0x6, 0x4bb, r4, &(0x7f00000004c0)="17a5e38b706d88ae308743243943abe63dd818cb4030ccf03cfbd708443a3016cf55a9e5196d30890a72fa3d5258b60352f11b8c12ea1d95155eae71405a5b286fece1855f6555e51f3e5dbd77acad6a831b786ca116e5cbc0fc593b519bc2f6b8ee8624ddbb1906b0dd15e68be2b475", 0x70, 0x9, 0x0, 0x0, r0}, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2, 0xffc1, r1, 0x0, 0x0, 0x80000000, 0x0, 0x3}]) ioctl$SW_SYNC_IOC_INC(r4, 0x40045701, &(0x7f0000000040)=0x8001) r5 = dup3(0xffffffffffffffff, r3, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r6 = gettid() process_vm_writev(r6, &(0x7f0000000000)=[{0x0}], 0x1, &(0x7f0000121000), 0x0, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001000030500"/20, @ANYRES32=0x0, @ANYBLOB="06510000000000002c0012800b00010062726964676500001c000280050029000000000008001d"], 0x4c}}, 0x0) mprotect(&(0x7f0000444000/0x3000)=nil, 0x3000, 0x0) rt_tgsigqueueinfo(0x0, 0x0, 0x0, 0x0) r8 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r5, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='rtc_irq_set_state\x00', r8}, 0x10) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/fscaps', 0x0, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000004c0), r0) sendmsg$IEEE802154_LLSEC_SETPARAMS(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000500)={0x30, r1, 0x211, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_NAME={0xa, 0x1, 'wpan1\x00'}, @IEEE802154_ATTR_LLSEC_KEY_MODE={0x5}, @IEEE802154_ATTR_PAN_ID={0x6}]}, 0x30}}, 0x0) executing program 2: r0 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000080)={0xe0, 0x10, 0x509, 0x0, 0x0, "", [@generic="6f6d8864d22a3f2ffaa46c88bc", @typed={0xa9, 0x0, 0x0, 0x0, @binary="2b0e13e735a3184f123d6da2f1acfac0ee2dd2b184b27db1f302de337c0004060000000000bf852c8986626691b01b2d44e4ce2d712d282dda5f2d23debbb86f9dba4a2dba4dbe076c02262600c446a567de243ab0d67683f7bb11c9cab3b3eed8a8bef4ff1631aa78acefca03c1a66db4424a8ba100022db228bb7b5eb5100e434db5dd5e995aa0912086d9f4606d2e4cc898739222c5d3a83cb6b707f3336336ebb7d681"}, @nested={0x14, 0x0, 0x0, 0x1, [@typed={0xd, 0x0, 0x0, 0x0, @binary="cfe7336f91087ba18b"}]}]}, 0xe0}], 0x1}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'rose0\x00', 0x1}) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="e80000006c00010029bd7000fcdbdf2500000000", @ANYRES32, @ANYBLOB="001000008000000008000f002000000014003500726f7365300000000000000000000000a40034801400350070696d367265673000000020000000001400350076657468305f6d614176746170000000140035006d61637674617030020000000000000014003500677265300000000000000000000000001400350076657468305f746f5f626174616476001400350001657468315f6d6163767461700000001400350067726530000000000000000000000000140035006261746164765f736c6176655f31000008000f"], 0xe8}}, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000300)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}]}, 0x34}}, 0x0) executing program 2: munmap(&(0x7f0000ffe000/0x2000)=nil, 0x2000) r0 = userfaultfd(0x801) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000040)) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000fff000/0x1000)=nil, 0x1000}, 0x3}) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xd, &(0x7f0000000340)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00'}) r2 = openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched_retired(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000005c0)=@newtaction={0x58, 0x32, 0x215, 0x0, 0x0, {}, [{0x44, 0x1, [@m_ipt={0x40, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x15, 0x6, "3869e0df2876e39979ba19d6ff15f23f8b"}, {0xc}, {0xc}}}]}]}, 0x58}}, 0x0) read$FUSE(r2, 0x0, 0x0) bpf$ENABLE_STATS(0x20, 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x5, &(0x7f0000000080)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x7b}, @call={0x85, 0x0, 0x0, 0x7}]}, &(0x7f0000000000)='GPL\x00', 0x4, 0xb2, &(0x7f00000000c0)=""/178}, 0x80) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000440)={r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) executing program 2: bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x4, 0x16, &(0x7f0000000140)=ANY=[@ANYBLOB="61124c00000000006113500000000000bf2000000000000007000000080000002d0301000000000095000000000000006926000000000000bf67000000000000150600000fff070067070000200000006a0200000ee60000bf250000000000003d350000000000005507000002000000070700004a0000000f75000000000000bf54000000000000070400000400f9ff3d53010000000000840400000000000073720000000000009500000000000000db13d5d8b741f2cdaabc8383caf56b8c2b84a8d09535a157f9005bd38addaa65b925cd3ded25b8b9e2a095d2c51ef45c5588ec78c7f32946b17cecfe54c53ab530c58b67851b7e0e82452a083b98a6aa766401047d150203b0417edef332233b081df18961d6822d133bf72a4de1c2ea17f00900fc211576846ac629d1d93265ba4580047a9dc88de358ce795731891a2031de4e09740c64e5506f991ed4785a9773a433e0db9c1a7d4ab9d658ce9cfdb4db3bed62bcb2bc91ddcdfadfe6d4421c49fb6641cbf56914e76702f673b586c767562a90a3967093b000e3806f825f1d0da2a304e06543b56d35235d78b7a7fe912971aab876022e96f5143b6234f5a6b701690b07fb664a44e22b72e843e7cf55f394cf75d1cd3ee79a25fb98cc45b3fde43e42e150d4a2fddd9a97677400ef0bd697d135324ce480c2960344de346bd511dea4ff7a07400b2d12dd1a8c4c300aee5f94cdd45b84234739031875e3008777085ca142b79dfc3aca5fadaa0532ab0572169f68584ff2ee063bc7e75ecd5cc8973464629ba236e3ff97f6033d0800000000000000cef54a60aff12590a50ef147e3e640193d00263003a4ef412420a070dd03"], &(0x7f0000000100)='GPL\x00'}, 0x90) r0 = syz_open_procfs(0x0, &(0x7f0000000040)='net/ip_vs_stats_percpu\x00') r1 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000001700), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r1, 0xc0285700, &(0x7f0000000080)={0x1, "0600000000000000c64c3b6e6ff82a75e5318fca4288c2ffbdbec772020acd2c", 0xffffffffffffffff}) openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SYNC_IOC_MERGE(r2, 0xc0303e03, &(0x7f00000000c0)={"e50d1af8899401000000010000007ea261dd00ff000000000000000000170020"}) syz_genetlink_get_family_id$netlbl_cipso(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) syz_open_dev$sndpcmc(0x0, 0x0, 0x0) r6 = socket$packet(0x11, 0x3, 0x300) r7 = dup(r6) r8 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r8, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r8, 0x4028af11, &(0x7f0000000200)={0x1, 0x0, 0x0, &(0x7f0000000140)=""/41, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r8, 0x4008af03, &(0x7f0000000080)) r9 = dup(r7) ioctl$VHOST_NET_SET_BACKEND(r8, 0x4008af30, &(0x7f0000000000)={0x1, r9}) ioctl$VHOST_SET_FEATURES(r8, 0x4008af00, &(0x7f00000001c0)=0x304008000) ioctl$VHOST_NET_SET_BACKEND(r8, 0x4008af30, &(0x7f00000003c0)={0x1, r7}) close_range(r0, 0xffffffffffffffff, 0x0) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)=@newtaction={0x88, 0x30, 0xffff, 0x0, 0x0, {0x0, 0x0, 0x1300}, [{0x74, 0x1, [@m_mirred={0x70, 0x1, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x4, {{0x6}}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{}, 0x2}}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x88}}, 0x0) executing program 0: syz_emit_ethernet(0x66, &(0x7f0000000000)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "fec000", 0x30, 0x3a, 0x0, @private0, @mcast2, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "18b088", 0x0, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @local}}}}}}}, 0x0) r0 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) r1 = fcntl$dupfd(r0, 0x0, r0) ioctl$SCSI_IOCTL_GET_PCI(r1, 0x5393, &(0x7f0000000000)) executing program 2: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r4, 0x5425, 0x0) r5 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r5) ioctl$TCSETSW2(r4, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r2, 0xffffffffffffffff, 0x0) r7 = fanotify_init(0x0, 0x0) fanotify_mark(r7, 0x105, 0x4800003a, r0, 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000100), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r8}}) executing program 0: r0 = socket$qrtr(0x2a, 0x2, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000100), 0x4) close_range(r0, 0xffffffffffffffff, 0x0) executing program 0: syz_usb_connect(0x0, 0x48, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000042ab9c4040200349b5f60102030109023600020000000009040000031699000009050402"], 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x48, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000042ab9c4040200349b5f60102030109023600020000000009040000031699000009050402"], 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init-fanotify_mark-pipe2$9p-openat-mount$9p_fd detailed listing: executing program 0: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r4, 0x5425, 0x0) r5 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r5) ioctl$TCSETSW2(r4, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r2, 0xffffffffffffffff, 0x0) r7 = fanotify_init(0x0, 0x0) fanotify_mark(r7, 0x105, 0x4800003a, r0, 0x0) pipe2$9p(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000000100), 0x0, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r9}, 0x2c, {'wfdno', 0x3d, r8}}) program crashed: general protection fault in l2cap_sock_recv_cb single: successfully extracted reproducer found reproducer with 23 syscalls minimizing guilty program testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init-fanotify_mark-pipe2$9p-openat detailed listing: executing program 0: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r4, 0x5425, 0x0) r5 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r5) ioctl$TCSETSW2(r4, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r2, 0xffffffffffffffff, 0x0) r7 = fanotify_init(0x0, 0x0) fanotify_mark(r7, 0x105, 0x4800003a, r0, 0x0) pipe2$9p(&(0x7f0000000080), 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x101042, 0x0) program crashed: general protection fault in l2cap_sock_recv_cb testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init-fanotify_mark-pipe2$9p detailed listing: executing program 0: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r4, 0x5425, 0x0) r5 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r5) ioctl$TCSETSW2(r4, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r2, 0xffffffffffffffff, 0x0) r7 = fanotify_init(0x0, 0x0) fanotify_mark(r7, 0x105, 0x4800003a, r0, 0x0) pipe2$9p(&(0x7f0000000080), 0x0) program crashed: KASAN: slab-use-after-free Read in __lock_sock testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init-fanotify_mark detailed listing: executing program 0: r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r1 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r1, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r3 = socket$inet_udp(0x2, 0x2, 0x0) r4 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r4, 0x5425, 0x0) r5 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r5) ioctl$TCSETSW2(r4, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r3, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r2, 0xffffffffffffffff, 0x0) r7 = fanotify_init(0x0, 0x0) fanotify_mark(r7, 0x105, 0x4800003a, r0, 0x0) program crashed: general protection fault in l2cap_sock_recv_cb testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) r4 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r4) ioctl$TCSETSW2(r3, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r5, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __lock_sock testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) r4 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r4) ioctl$TCSETSW2(r3, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r5, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) r4 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r4) ioctl$TCSETSW2(r3, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r5, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) r4 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r4) ioctl$TCSETSW2(r3, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r5, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) r4 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r4) ioctl$TCSETSW2(r3, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) r4 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r4) ioctl$TCSETSW2(r3, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-setsockopt$inet_MCAST_JOIN_GROUP-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) r4 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r4) ioctl$TCSETSW2(r3, 0x5425, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r5, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-ioctl$TCSETSW2-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) socket$inet_udp(0x2, 0x2, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r2, 0x5425, 0x0) r3 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r3) ioctl$TCSETSW2(r2, 0x5425, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) r4 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r4) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r5, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __lock_sock testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-io_uring_setup-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) io_uring_setup(0x2ad5, &(0x7f00000001c0)) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-ioctl$TCSBRKP-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) ioctl$TCSBRKP(r3, 0x5425, 0x0) close(0xffffffffffffffff) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-openat$ttyS3-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001600), 0x0, 0x0) r3 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r3) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program crashed: general protection fault in l2cap_sock_recv_cb testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r3) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __lock_sock testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-setsockopt$inet_MCAST_MSFILTER-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) setsockopt$inet_MCAST_MSFILTER(r1, 0x0, 0x30, &(0x7f0000000980)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000300000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000002000000ac1414bb00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002"], 0x210) r2 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000000)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r3) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __lock_sock testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r3) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r4, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r1, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program crashed: general protection fault in l2cap_sock_recv_cb testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-setsockopt$inet_mtu-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) r0 = accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) setsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-accept4$inet-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) accept4$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0x0, @private}, &(0x7f0000000140)=0x10, 0x800) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r0, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r0, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __lock_sock testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r0, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r0, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __lock_sock testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = io_uring_setup(0x2ad5, &(0x7f00000001c0)) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r0, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = io_uring_setup(0x2ad5, 0x0) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r0, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __lock_sock testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = io_uring_setup(0x2ad5, 0x0) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, 0x0, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r0, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program crashed: KASAN: slab-use-after-free Read in __lock_sock testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = io_uring_setup(0x2ad5, 0x0) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, 0x0, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, 0x0, 0x0) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB="02c8000c00080002"], 0x11) close_range(r0, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = io_uring_setup(0x2ad5, 0x0) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, 0x0, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(0x0, 0x11) close_range(r0, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init detailed listing: executing program 0: openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000180)=0x4, 0x4) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = io_uring_setup(0x2ad5, 0x0) close(r2) setsockopt$inet_MCAST_JOIN_GROUP(r1, 0x0, 0x2a, 0x0, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) connect$bt_l2cap(r3, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) syz_emit_vhci(&(0x7f00000000c0)=ANY=[@ANYBLOB], 0x11) close_range(r0, 0xffffffffffffffff, 0x0) fanotify_init(0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: KASAN: slab-use-after-free Read in __lock_sock simplifying C reproducer testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: KASAN: slab-use-after-free Read in __lock_sock testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program did not crash testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program did not crash testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$dir-setsockopt$inet_mtu-socket$inet_udp-socket$inet_udp-io_uring_setup-close-setsockopt$inet_MCAST_JOIN_GROUP-socket$inet6_sctp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_emit_vhci-close_range-fanotify_init program crashed: general protection fault in l2cap_sock_recv_cb reproducing took 1h29m5.988351031s repro crashed as (corrupted=false): Oops: general protection fault, probably for non-canonical address 0xdffffc000000002e: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000170-0x0000000000000177] CPU: 1 PID: 4478 Comm: kworker/u9:1 Not tainted 6.10.0-rc5-syzkaller-00282-g8282d5af7be8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_publish_rx_avail net/bluetooth/l2cap_sock.c:1137 [inline] RIP: 0010:l2cap_sock_recv_cb+0x1af/0x4f0 net/bluetooth/l2cap_sock.c:1509 Code: 80 3c 07 00 74 08 4c 89 ef e8 bd 66 7c f7 4d 8b 7d 00 49 8d bf 74 01 00 00 48 89 f8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df <42> 0f b6 04 28 84 c0 0f 85 b5 02 00 00 41 8b 9f 74 01 00 00 49 81 RSP: 0018:ffffc9000d0373c8 EFLAGS: 00010207 RAX: 000000000000002e RBX: ffff88802ccb2000 RCX: ffff888030103c00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000174 RBP: ffff88802ccb3000 R08: ffffffff8944f610 R09: 1ffff1100599640c R10: dffffc0000000000 R11: ffffed100599640d R12: 1ffff11005996605 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7a647b1440 CR3: 000000007b026000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: l2cap_conless_channel net/bluetooth/l2cap_core.c:6774 [inline] l2cap_recv_frame+0x8d47/0x107d0 net/bluetooth/l2cap_core.c:6827 hci_acldata_packet net/bluetooth/hci_core.c:3842 [inline] hci_rx_work+0x50f/0xca0 net/bluetooth/hci_core.c:4079 process_one_work kernel/workqueue.c:3248 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329 worker_thread+0x86d/0xd50 kernel/workqueue.c:3409 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:l2cap_publish_rx_avail net/bluetooth/l2cap_sock.c:1137 [inline] RIP: 0010:l2cap_sock_recv_cb+0x1af/0x4f0 net/bluetooth/l2cap_sock.c:1509 Code: 80 3c 07 00 74 08 4c 89 ef e8 bd 66 7c f7 4d 8b 7d 00 49 8d bf 74 01 00 00 48 89 f8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df <42> 0f b6 04 28 84 c0 0f 85 b5 02 00 00 41 8b 9f 74 01 00 00 49 81 RSP: 0018:ffffc9000d0373c8 EFLAGS: 00010207 RAX: 000000000000002e RBX: ffff88802ccb2000 RCX: ffff888030103c00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000174 RBP: ffff88802ccb3000 R08: ffffffff8944f610 R09: 1ffff1100599640c R10: dffffc0000000000 R11: ffffed100599640d R12: 1ffff11005996605 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7a647b1440 CR3: 000000000e132000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 80 3c 07 00 cmpb $0x0,(%rdi,%rax,1) 4: 74 08 je 0xe 6: 4c 89 ef mov %r13,%rdi 9: e8 bd 66 7c f7 call 0xf77c66cb e: 4d 8b 7d 00 mov 0x0(%r13),%r15 12: 49 8d bf 74 01 00 00 lea 0x174(%r15),%rdi 19: 48 89 f8 mov %rdi,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 49 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%r13 27: fc ff df * 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 b5 02 00 00 jne 0x2ec 37: 41 8b 9f 74 01 00 00 mov 0x174(%r15),%ebx 3e: 49 rex.WB 3f: 81 .byte 0x81 final repro crashed as (corrupted=false): Oops: general protection fault, probably for non-canonical address 0xdffffc000000002e: 0000 [#1] PREEMPT SMP KASAN PTI KASAN: null-ptr-deref in range [0x0000000000000170-0x0000000000000177] CPU: 1 PID: 4478 Comm: kworker/u9:1 Not tainted 6.10.0-rc5-syzkaller-00282-g8282d5af7be8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: hci0 hci_rx_work RIP: 0010:l2cap_publish_rx_avail net/bluetooth/l2cap_sock.c:1137 [inline] RIP: 0010:l2cap_sock_recv_cb+0x1af/0x4f0 net/bluetooth/l2cap_sock.c:1509 Code: 80 3c 07 00 74 08 4c 89 ef e8 bd 66 7c f7 4d 8b 7d 00 49 8d bf 74 01 00 00 48 89 f8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df <42> 0f b6 04 28 84 c0 0f 85 b5 02 00 00 41 8b 9f 74 01 00 00 49 81 RSP: 0018:ffffc9000d0373c8 EFLAGS: 00010207 RAX: 000000000000002e RBX: ffff88802ccb2000 RCX: ffff888030103c00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000174 RBP: ffff88802ccb3000 R08: ffffffff8944f610 R09: 1ffff1100599640c R10: dffffc0000000000 R11: ffffed100599640d R12: 1ffff11005996605 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7a647b1440 CR3: 000000007b026000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: l2cap_conless_channel net/bluetooth/l2cap_core.c:6774 [inline] l2cap_recv_frame+0x8d47/0x107d0 net/bluetooth/l2cap_core.c:6827 hci_acldata_packet net/bluetooth/hci_core.c:3842 [inline] hci_rx_work+0x50f/0xca0 net/bluetooth/hci_core.c:4079 process_one_work kernel/workqueue.c:3248 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329 worker_thread+0x86d/0xd50 kernel/workqueue.c:3409 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:l2cap_publish_rx_avail net/bluetooth/l2cap_sock.c:1137 [inline] RIP: 0010:l2cap_sock_recv_cb+0x1af/0x4f0 net/bluetooth/l2cap_sock.c:1509 Code: 80 3c 07 00 74 08 4c 89 ef e8 bd 66 7c f7 4d 8b 7d 00 49 8d bf 74 01 00 00 48 89 f8 48 c1 e8 03 49 bd 00 00 00 00 00 fc ff df <42> 0f b6 04 28 84 c0 0f 85 b5 02 00 00 41 8b 9f 74 01 00 00 49 81 RSP: 0018:ffffc9000d0373c8 EFLAGS: 00010207 RAX: 000000000000002e RBX: ffff88802ccb2000 RCX: ffff888030103c00 RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000174 RBP: ffff88802ccb3000 R08: ffffffff8944f610 R09: 1ffff1100599640c R10: dffffc0000000000 R11: ffffed100599640d R12: 1ffff11005996605 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff8880b9500000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007f7a647b1440 CR3: 000000000e132000 CR4: 00000000003506f0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 ---------------- Code disassembly (best guess): 0: 80 3c 07 00 cmpb $0x0,(%rdi,%rax,1) 4: 74 08 je 0xe 6: 4c 89 ef mov %r13,%rdi 9: e8 bd 66 7c f7 call 0xf77c66cb e: 4d 8b 7d 00 mov 0x0(%r13),%r15 12: 49 8d bf 74 01 00 00 lea 0x174(%r15),%rdi 19: 48 89 f8 mov %rdi,%rax 1c: 48 c1 e8 03 shr $0x3,%rax 20: 49 bd 00 00 00 00 00 movabs $0xdffffc0000000000,%r13 27: fc ff df * 2a: 42 0f b6 04 28 movzbl (%rax,%r13,1),%eax <-- trapping instruction 2f: 84 c0 test %al,%al 31: 0f 85 b5 02 00 00 jne 0x2ec 37: 41 8b 9f 74 01 00 00 mov 0x174(%r15),%ebx 3e: 49 rex.WB 3f: 81 .byte 0x81