Extracting prog: 33m49.875441003s Minimizing prog: 39m10.785301796s Simplifying prog options: 6m36.992722498s Extracting C: 2m39.47246347s Simplifying C: 0s 30 programs, 3 VMs, timeouts [15s 1m40s 6m0s] extracting reproducer from 30 programs single: executing 5 programs separately with timeout 15s testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$IPCTNL_MSG_CT_GET-openat$tun-ioctl$TUNSETIFF-socket$kcm-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_BLA_BACKBONE-socket$igmp6-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$SIOCSIFHWADDR-write$tun-sendmsg$nl_route detailed listing: executing program 0: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFQNL_MSG_CONFIG detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet_udplite-ioctl$sock_SIOCGIFINDEX-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-mkdirat$cgroup_root-openat$cgroup_root-bpf$BPF_PROG_QUERY-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-sendto$inet-socket-socket$inet6_mptcp-socket-socket$nl_rdma-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-pselect6-connect$inet6-openat$cgroup_ro-ioctl$FS_IOC_FSSETXATTR-getsockopt$sock_buf-socket$kcm-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$BPF_PROG_DETACH-bpf$MAP_UPDATE_ELEM-sendto$inet-getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-bpf$MAP_UPDATE_BATCH-ioctl$ifreq_SIOCGIFINDEX_team-sendmsg$nl_route_sched-unshare-mmap-openat$cgroup_ro-bpf$OBJ_GET_MAP-bpf$MAP_CREATE-bpf$PROG_LOAD_XDP-openat$tun-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun-write$cgroup_int-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 15s testing program (duration=22s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 19, 30, 2, 30, 14, 3, 22, 22, 13, 30, 21, 3, 1, 3, 6, 20, 5, 30, 4, 16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba399654"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000001800)=[{{&(0x7f0000000100)={0xa, 0x0, 0x0, @local, 0x7}, 0x1c, &(0x7f0000001600)=[{&(0x7f0000000140)="87", 0x1}], 0x1}}], 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f0000000400)=[{{&(0x7f0000000040)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000180)="d7", 0x1}], 0x1}}], 0x1, 0x0) shutdown(r0, 0x1) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, 0x0, &(0x7f0000000b80)=0x98) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000000)=@assoc_value, 0x8) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x200000, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xb, 0x8, 0x10001, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000006007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000003000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_free_blocks\x00', r4}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$cgroup_pid(r5, &(0x7f0000000140), 0x12) ioctl$SIOCSIFHWADDR(r5, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x0, 0x2, 0xc2, 0x0, 0x87}}) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000000200)=0x5) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000080)=@assoc_value, &(0x7f00000000c0)=0x8) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000240)=0x20) executing program 2: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) shutdown(r0, 0x1) ioctl$int_in(r0, 0x5452, &(0x7f0000000180)=0x401) listen(r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x7, 0x4, 0x18, 0x28e, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1a000000}, 0x48) syz_emit_ethernet(0x6e, &(0x7f0000000a40)=ANY=[], 0x0) socket$inet(0x2, 0x4, 0x5) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) accept4$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x0, @multicast1}, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4841}, 0x4008040) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) sendto$unix(0xffffffffffffffff, &(0x7f0000000000)="ba", 0x1, 0x0, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_80211_inject_frame(&(0x7f0000000580), &(0x7f00000005c0)=@mgmt_frame=@deauth={{{0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, {0x7fe1}, @device_b, @broadcast, @initial, {0x6, 0xff2}}, 0x4, @val={0x8c, 0x10, {0xcda, "03ea8fab3993", @short="8cdb61da7a44de6a"}}}, 0x2c) syz_80211_inject_frame(&(0x7f0000000600), &(0x7f0000000640)=@mgmt_frame=@reassoc_req={{{0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1}, {0x2}, @device_a, @broadcast, @random="63be324a0fcc", {0x4, 0x5}, @value=@ver_80211n={0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}}, 0x2401, 0x400, @broadcast, {0x0, 0x6, @default_ibss_ssid}, @val={0x1, 0x7, [{0x2, 0x1}, {0x30, 0x1}, {0x5}, {0x9}, {0x48, 0x1}, {0x1, 0x1}, {0x1b, 0x1}]}, @void, [{0xdd, 0x3b, "594a797e30d1dd375a826be7e47ace4143197d9dc217675a04b829c465bdbe8c762478c852e9243a0ba66925b9c9ff47ed51466d0664f9bd5263f5"}, {0xdd, 0xff, "dd562850524ad635e5eb558ef673b7411f02bd1a6bc1bb95e2a1d5f8c74a0493f26f0833379c597a51ae6c2f8889a2ec01be9e2b9d69873d7cad79eb89ac7b2574a79a7cc8325b1ff4f06d755ee04db036bd30b7865d936a760c92da2f12eea62b8f60338c1edf3073c7b524531180168c354f3bff42c59a1982862cf457164f91c747d22ae23f033246095db6405d4bd2c0366cf6ac7c29840490bd17347141d820bb067b9d5495cedef1c0a43f49a1b3f7d009b43fd65cd37a3c96c8612c3969ce455f32de13388ac2b2f1031a6e5b9b6a05613754c43a5d95121e361a0bd5ab6f11bf7cce86c796142e1ec734ca2213f15f6dd9857b463983529d0cd2fa"}, {0xdd, 0xf7, "e81294f3e1f9c818c01e1cf19b9a56ba8890d432f9e71fbd63d06d50e4b37b5b88e763bfce2be85bbfa09a761419c89611f63a7fe6356de1968268f52707635417f856a5ca85c34bf46db4edcc493cd1ecfa6ba1df0124ce54310e1ce673779bc2151777d04de6ecc7a53f8776f191ba3a99c62af3223200a317ffce555f80c2c258b86e221aa527bee3791317fa2cbdcb6f8c157bd55710a4d69784b41ead2b0acb63aeed98d39920484189a1a88580bf1ec5ade86362080b9f62720daf77e552b68dace1797e9eeb161322fe7c91bbdbe7f341b94ea217d1cadcb060901cf3084f0a69c2894ecfa850a45a2bd5f89e486fe7cb6fbbf5"}, {0xdd, 0x96, "5a14f31bed0c4d8268205654d3cefac1853382a597e60f54bde924024e43057259baf30ca5af04020e0504d61f793fceb851cbb2f4bf74068425d73686ec13e8650034d3a63fba8abe8d690a6f798800a821be264e50a55d655c0ac34315aeea1a81ffaaa065223e4442d7c5ed7a5c4aa5c55d067635b52dd7d20db2efbce48fef431b686199ed723620a545d19f302ba1a2bb561d1f"}, {0xdd, 0x1a, "3fab9fc81e124890f4388ca2c73a93a2e7356fc6c58603b6e534"}, {0xdd, 0x92, "e29028f61963a56574505b2f2fcc37e5b44c3da5dd5b2b182d5eb0e38899e4c62151f85246fafc04cae06e2a719044d98e05c93345eb94ac75870a39fc32505360fefc8793468ede8cc085169b04f6b3a5c40c3b613d99e7a85a3ba3b6a712be1502c13e7d2acf0f64c223b16cec73dd454132d022aec40135098dc8168e76ab113c56d240616c319876e9c4277622067ef1"}]}, 0x3b6) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000001f80)={@remote, @broadcast, 0x0}, &(0x7f0000001fc0)=0xc) sendmsg$inet(r2, &(0x7f00000020c0)={&(0x7f0000000a80)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10, &(0x7f0000001f00)=[{&(0x7f0000000ac0)="21c9a91eaa341744058cc56feabc8bc6365d3e755d8ec1a63581e95a3d1af795209c58ac879ef4fa08f844004f6c0bb4d7d221c187727e7b7631c8105cce2f2c2d0642095ca71edac01b6dec21bae844f386259e4d0f491a1b45089dfc39820c0bbf57a95d5b1ec3ade91f66e0ae27ce4926be2085b5d26a71f49fc346a5870bcd48522d8d6474a3aea2b8fbc9ba2678e5212dfea84fc539", 0x98}, {&(0x7f0000000b80)="c4c695cb11baed5933827ffb1ca5185c8e3114823cd0159a1f156b7565bc", 0x1e}, {&(0x7f0000000bc0)="5600b165f0104b1154128715b5668fa77088849bc95548278d358b20237549a416e1768d84cfc2c206682b04fc75144870c21f031b673c6e98d605a13ec5dc84e22197c27f3ad70322bafd4eb65a27c58caf68cab9dfeff76f50927da10f4f098599a7a6483507deda80cc06e80c46d6d49a659c5b7ea3cee13ccccbcc15ab33bc34fbfbf7f23a835a74e4b59c1c7699b08cfad0cfe85d5f294a07e01a6cbb350a340378392c12c76588a3eb0251b5cf63823d39f140aa338840ec47bac74dc4cb55ff82fe79f3f605390110104f50cbdb740437ee56e237f4afb66df6f59db4ff949a95a257b272d736558f6cc9d7b3703b1dd54bb620a987e27ef7a3395eea6dbed507526c1990d3bb2f82a11e8260caff5aed08a7b85ecf6a14495432915eb7d54ba74d3641bc04d377bef145240da54bea03569b5e396d17a581d73dd7807a083808c742dd5e7417c7daac2b332639edfcb4f3a3839b09cf4e0d898bfdb688a3443b6c4987152ed38ae3c3f7e22b0cb963835c648c6b07cf773e431203c9261f640126d45704cdfd55b971ca0bb9e11ab301ff54d63af5ea9dd6d2f1309c00d2241b9978070794418e0c6cdfdba5f295fb39d677a27055272ed86cebabf3ea5a185dd54aec32d27c3af440ffc89d31d609d7551f3a7a6884b57841d860ad9a0ba1313e305f3ede1289778864e1bf6fe7d88e1bc8f50081205171d47566d4ecf3482994a2607e05a5a62ce1c39f3f99948c1e2e118d9e46a626a17741e1c906510a27365bd545c3440dc2ec0c2d5a18dd4d30c97a34e90bca0cfaaa0f0aeaa3715da5f1afcee0b968334b9a33cc0895fc45091d6262f3c9ea7d841e730e8a27eb52edc43eb4d7ad91e4037418336d3f0c3e0d90b570144bbaf4ad590c9cf80c8347e8531f2692d433d474b4585b738b45227f686242f0dad29f947f4e4eedda78dc333cd658f9f4f3395431fab7bc4c699cdefb8970775727be2f1cbce8603f9a3c436fdd567cf0222d17e5b3c27f8d4ff773db7919cd6f9e48070aeb3285d12dd100ca8fa395ef4d395195b771103994db70199b908988e5f3a3e34399ebf4726011bb2e8f5b88240b54c28945c957292c3a693fd6e8bff1ed61f32f886a9499178a97210793d847b636f1c80cbd3d0a89f97d1993c9f47ab104b889c12deeb373f0877bec0b20615979c482c27a26c047a85b115956c33760d684f91e39c66b03977637f236aef96c1ea2a0d4d88a81d95b947d9d8341c1da38360576ea428ab38c44d27175e8c279e5f37e1a4244f7879d83b15994a97ab5abb18bd9d57cc44eeac145c1b607a2ac4bc0b27488dad72ccfd6c07162c84200c2df2eb03f5f90a40928829f9e4ae10a8126fee7f519a21d99a8fb495e4c6761702ae97ce99ff1501e47337de7cbc457b9d215a5149f852fd155a0c998808d230c43c55472e35eaf75e821a325ca16f26083bee98c81efac36895d9ee582b7fd78406e7c2f246f8702855572a865fae62d60bcccb9419d706caad29c70178dc0f70e5175a6c8de3bc729dd5772dc7ef1396899493115c7418eb97d7b6e2c72d22def2a56af6d6fe9db4bbc905efb696342992338b8ce538931a803d638dcd49be4608469da2995a90fb769c260c74f84c64563608fc890bb7c0778bc7d3ff5bd23f5fd69bdb3a19c784c529212fcdcc54fdf7d946fd1c1ce6c4c24398ba18426cbbfce3d9c732cc4f10e8a971ff3ac4675db129bf04c9e9e35bf9897ea593e8f648ec2f7f479608a70b9cf8e1e9120db15c9855d082fc170b9808a2358b96a59d60720027f8d7cb86ba7ae99be8bb9e15506fa82a0db803dabff5898fb4c88460e1d6b1f2826be331c14e0da8e08afcfe32c02ee0a7e1ce2627b9f23e146ad01f01992419ee6139e3afc4d678bbd51de55af7f62af3ba44e5563ba66df58d021d47d02853da476d9fcbc49d8049238c694b734f4add99aaa521b21a54f50e9ca5771218ecd51e5de2153b096ae80930a8cac6d41a7e4b28e27284a33b7da78543c5006914f433b8143f8f484dcde986e81a5b8788f7efa49f88aa6a8564a5db34a48fdb75bdad55944a43e5ae7840da3c96b93a7c71e4c87596eac0dd9e0cde47c7b52fcde7a002be208300e7facd22482e2a9053bec00fe0e221263379846cc8ca1a25bd9cd7dab32ff41402afa66b619897ca9dc57b94c8f2b181061008c7cc083b73ae231808a652d9ef7e2dd570a6d0d046139cb4457dc175e3e26f66a20f9cca9ec8dfccf3a2995f886eea69e67d305bea7e02415e4f4dac6e6e718e15d211b03f2460deb19377606df30f64a30a493678f072d50ad625a5b2f5bbc90b107033463181c609c2fa88eca0a4936172b133edbd06ac15288f3ef20ae3c418b19de22130a85207ab80580bd0f36ccb2bdd69938a71684ca3ac17462b14fb0c65eacfc67e6ff67d694b41a05a4bfae9f4c6e81b685ae630701477a7737bc1ff2034dd56ed05cc75c3fc2310cd528659429e0dbe2c56f367d325bc4ad4e756af619804b67b8dd88784b61b52560145e96ab0a36112d9b9beaf85738cce2ae213175e7c7191d091bab5a19c337040e470158d31fa78781cfb649fec58951216cbb983004f9da9a56b510aba67dd047d17fe97f29b21b4e6c88bab3b8514058ff756ff4083e345ddd818ba3748472a1fa37641c9da4cdc64a9618900e012bb93d594d10b38fb5c5616cc24334ea370a8b73dd09f13fe235ffc317cecb6f11b74a2630be55ddc1e409fb4fd65a7bdeff1a963a9941d14faed475dd726b6015df57a130bf5cd7dc1def8187839978f5e915457e92a0aa4180a9baf2b65a69558e8a05116efc4e076b8d845ab2dd29f8cac6ac9f708f7c5283ebef8589f6e9e74e7da1e430712a2500f17a7526dfa18be7e3eb9cd1f8dbe5b2268102f10a0b70bdc7a8dfa9c191eb03f4df8e37b12051f051ea9d098e8e376991741a06279c18d2f2c37caad0fe2287acb2be790c45362445ef9d423540e5db9864d8230edd1516135e208cda037f98fa9f87fcf4e34ca60e18ffec9de595eea96cada4b4d585ff1ebbbb1b577fd54e50afc4b788f1de83c3aa665271ec5bfa1c3d8420815ae0a12b854087f57e3bb26f28580f55ba15b01f1e2cef653601d7c8fdd615bd4294c05d3cb13e8b87de3ac80bece4529c576010fb35974e63052cca52dbe2b3f535859a1d48b3f5b9c7a11cd963808164b38ca5b5194f4acdb9c9bd16784ad28b653955e08ac184990273fea3f40546051fb4003a787e681841a9cb2c3be98890f03cae41979839deda4d89bb361df7afcb1e5d1416605f46404f0af62708aee9dc71e2543873775febffc6d0374c13fdc57d661ca3588d956e5804de0d83275bbaa01a5f6fe9a9ed1d6e53e3c68d496ef174acbf69579d089f1a83f2f6c0c9d6916dd78400c605baeeb19a048670dcb8e4cc01768edac3de00a5049aad8940d9134b3e5cda6b4c4c87b1af2de92a9d51a2b12114046a3911cda83a2adc1161951214258e12342d9993de5954a14a9a30e38ef7c1584ee3584e29d0e19bfae57e5694b95e0ce826042866998c9510cceaffc0f8782639f2d8eec66433a72fef931cfdb3d6736e2c0cb1c2c40decd2c5b18b7fd09079cb92d348d6e9db1660655ce5775530f9d4564536302b52b0d5627d7a06812cd438437a5e84087b7290864c3d55246e8213af66b1cdd465a80532a6b3a31d81c5c7efcae3d7ee4b5a2d36fb4b421f4b4d1582b2965fd27904ed24b2429d8cb63167c48fa044ef56d5d199b92cb91c8c692ae8890b94fa1129a8e01ac6e258758d8f553c248026b40bad0df58ad78f7e215ed9e565ac57c314bace76fd583adc9e0fab31271f168751f808b368b61042a1df6db8aac747c227d1f5ad3b212d247ab019c3873c4b06f955201f2f0249b3ddafceb8a79fd8949824ecc401193e20b17ed581ff45a41dad176bac8c2a4639ff1cb82d8a5eefbd43fce904433b1cdfc5d8a52ee37ac09b22aa145a72e9bc81ce0453710d11e2d5bf69fdbdbcf5738ac748375b710083073563ca98031423c9e0caf10a1c7b5d6bfcf4f43ad8e20b3ebdcce0692f6fe34caf7b9197e00983a7434961f23de17ae251a13355af4c7c97cab62ec35c618b0d638c7e15eef1df234f6a469edc29ff2673cc8064d889cd33edc87129d8158a221ad891bc8ba93791e804ef403beb505d001eaad272f1f333d6aef4473d698a65463b15881717b8a9c547fcc89f7b03dc159a66fa27157579993ee70dd32db93e82f0a8861b13a52eea7f6b08742140d177d60d05eb3079d88da08dce5eac39851ed9fdff0f4075188cfdca5c32af728d484b680d5eae3f4aa3382d85d6c589cccfa491fb1968c92f14f372380d3ccf62e6bddaf8e86aab14d0b15da19adef27ed0a5e7535176537f73ee4d60c20b8d1917014dc958fc8d4a03d2a2e0d080ae049aeb8711378bb97fadead9922cf47dd01f752d1d17b099fd73d51caac926bd9142b7fd18cd047d766c21fb64f487b43be3c60af81b701eb45c92e5a522e5a572b6fa19bdbafdf850469c2f23f7ad7a33274c7f455fa92afc59d7ced2172937aa8b3719f615923d414859618aa710e38e536aee5826a3cee9118ad79d0d8fd1d8adaf5493b344a1dea382c8f2a1ce3ee3e7630b6f69738832bd3fbc90889ad64c7e84cb98dc7baf9a366785f37ab56f4d40ed4ffb584a1c1328372ef27c4836c38551ffd1c36ef0e02911f1d84c1e88b09dc451cd1d468d44df2db6fa755843c9b707dc09fa321d88c49e6a054072738ba2bc69e86c8f9704fd49704ca567293b3083aedaf49e358c67bb002c3ebf3ef20184f0cb4c546b7f585218bc0ded90a07a34cf9f06d3326801c6462abbabfb7cfb4074b90d408f45bfa37c6d65788fe99fad5e0d0d3f3afe7e4d9c01207f51a167ab34f2a0c63bb61d27065f93dbf92aafb9e45f4fe3506e46bbca0cb4920c884bbe8cc942912907f8761dbdec331e471bd17fdd4906c71d545829b4c60db545a52d142d1d81778ea714aba0082cf158bb791f9618a0057037ad80f87bd8f8d76a29563e8ad0ae85492aafc35c051bb5895575671310f3e25b2500ce6e7f254c5eec4b26e639e7891f111ec505065c0ba0464a6ce0c27478c34b362b1cb629ba9fc50cc73a730aab29516dc8b179f89164a0bc7828e1a82302c8a5a3fb18f4718799900c8834e9d8c59541d6f1c78b0d96937f0a3415837f72ca8b26f9dd4f775d552cb80ab1e8021a5f68e109ae29cc22e293c63061c003330d043f78f391a7ebed77b7099a893dd0202d6d82cf84ec8defbc6c7e5946e8a0f6ba325410ab19a0dcd6fb0fe9e0c4436365933271244f4049d75acebf089528f4db1245a06f010d26ca9b4d67ba23af39fd4b996c7f6c40beebce2a15d1be2bd638a34e836018a53abf7f3f439d5e48067f9822b283830e841f6cd0c711f7dfaab556d440946e2077ae9c0ae1fa056c32c20d5e3f57d3fbb280ff6b88188b0ce704c09343e9446eacb5b4e068f532b780dbbec6f202a83e6b5de843ea0e4112af44e87e20c7387eb49b15c245f5d05b31bb21ec32dc7ac3866a547b791513e9b66d8ef47a7829d1e8609d50c15963ad29c5007e3ca6067e395e27eb2739aca18564a8547c3acc898bcbff55c766be4ca459aaa6a22fc22a99c76b563e27f1f9d14d6c2dc0c186707dba08c0e9d89e3bb9b2c71fe4b0264d6f7cdccf4152e18b8a8d213f2eed1f8fb503e59b5d04c739a561408ad58a0eaf6b33d8da876538704c3b1ecb", 0x1000}, {&(0x7f0000001bc0)="1875b08c9565cbeee53135cb7e48ad0fd189990e6290b1e3191212332b2e3bcf429b4e62fdface0a6dfc68a189f387b0409f55f7a3d1ff4e5d95e6891a1485fd0110df9d80e216bfa0b7880cec849ca4bd8d43ce55e5d82ddf38785697bec96dd195a9e7b8f170586bc173a1ed9ad5508ef41baf25b62750f55cff29a1117f3b660fad518e62023524077c72945185196f1c554060c5391daee355e1b7a7f646cc8b01999bf6d263fd0f4e15224c0e9f6c4504f4e1feea6887f24755c39b14b65bbba650a03f17ec863ba73f34b9ce5819f087ee1e44694b69c6dfaca46f5b0d7b7a28868db744", 0xe7}, {&(0x7f0000001cc0)="6b97d069fa0f02237b33465b6138d43ee4da341c7c75fb26233d7364c536599ebabeee50d79ad6d4e22ee6db4e6ce49f6489db2a614deca885a8f84255f5477ea645a44f7e7b1819f51c210690f7fe490fae42f9f495d60b3ba35e5ef4af885be180f59a80c6bbecdf0ab352a04296d85bd68f4d9d42df7d0c8312f24420335fd09a091b42d8f1f1017aaecae84f02211847e28208f6c83c9126901fbc9383b8695e69f9e57beee70e18d9a6ee0f1d28c710b67e95f3c525d036a955f8f19e8aa21bd4b94f35b129744483a937e51242f7cc36ea858c54075ac739d6cf469a421334889f15d73cc61021c9b65300a3f3c99cb9", 0xf3}, {&(0x7f0000001dc0)="417a8dd8b078a717752ec75ee84a75da47daa213aec763e5f1a69bbf130a35839bcd22d1faad19addc2ee88b7c63dfa70fc291797c9a55bf07a60ae77fafd6481891dda218bf798a269766836e8c50afbd688454ea4a24e080d4a0e673926f0d311bfe907a26ceca9c608a9a83cc07a3000ae3152bc49765fcc47aad6b0382983b6c79746f7f408673cba3d91e3d5c6fcb788c6f13c4d65d334592fbc944ea85", 0xa0}, {&(0x7f0000001e80)="ff747dd4564c6bc2a23a693249961d3435f7906e1a286a418472eff6e68bce848ffbf0668ec7a535b4945323538108f3261c8282d72917e03ad99e2621ca5a112d36f401a3a685e4e5670b3a14816fb6807e61", 0x53}], 0x7, &(0x7f0000002000)=[@ip_ttl={{0x14, 0x0, 0x2, 0x7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @local}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xb8}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @local, @dev={0xac, 0x14, 0x14, 0xc}}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xbd}}], 0x88}, 0x20040000) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000002100)={0x0, @multicast1, @local}, &(0x7f0000002140)=0xc) syz_80211_inject_frame(&(0x7f0000002180)=@broadcast, &(0x7f0000002840)=@data_frame={@a_msdu=@type01={{0x0, 0x2, 0x7, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x6}, @broadcast, @initial, @from_mac, {0x9, 0x2}, "", @void, @value=@ver_80211n={0x0, 0x7, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, @a_msdu=[{@device_a, @broadcast, 0xf3, "5211ccb16bb9380ff226e84e2637ddfc58611c368dc46ab8ea3a91266a27c87880d34495e15d737d547d0f48f04e7a1d25f98544031e5a3ab60ac521ff0f4260e4d11c252b5eef9b21f83061339e686141ba1e7b744e79d1013011f2842f6d0022ad362896c230db53bd7c738810249c679957a4d1448aa2213c6ea7883bc5b58e62a57825be64d192b43cfc6026d658ecd158efd15369e857dcb21bf48212e1d800e1ec43ef5b858c36ec0eba2b0f9410a0218c97fb8557998de584a7950511012b072bb989107f48d13397ec258e4811633ba5546b9bb6ac8311b332093f6f65f6ff8ee69e02a1252a3f41c2e3b7979e5a81"}, {@broadcast, @device_a, 0x1000, "1e430a00904481ab069b7645f9b1703a70f65182bc503084faaaf5ea36a0503b7da9177eef0eba3c064671c85267d20680760e206e0d129dd88dc1b1427e53b4c53106f082231b712090b0f7cb00e8b21f8d3571319b914e997d3913ef5c4b3b15caf3dd5dd18343c6fac3762a92a06370376e6065af5151ee42b1984405f070bac97c9493013fcab743fceb9d2c2fc48992a780c2a68d3269abe6a7781c0f7f93a073c3f88bd7b10448526e0752778833de6a4172c051d1a30ca96b6bde67c7d715fcda27cce51c6c602933369282f308ff0037c602affa5a76c7a2ac3f1bef6049cf6452dd549c8ddfc923286bc3d57eb0fb5b868cf03a23e2d673ae2d371ae8091dfefff408764dbbd6db160fbc9d1e34d04110f3a57709000f4ae71e59ae43b7bffc6b5f36321caea5aa0a48232c1d9257542b7a006ce2412c4f56385ac31fd324cec5a600962332fcf6c133aca7bd82eaa97044488d85e920ccc34bd5c7ee814ad3102f8fe360662ea4cd276b3e62fe181a143acedba5e231513a944b8a9d015ed9882d28d12532d792f6b88345edca126de20d1e64c33c870009f867e6ce4fb3a7900507720386d0120567b73178c401a76261ec186c22c3c6bd812478b844d0ee70dfc1747ed9343f2e9cb9ba85538885ea4c684db5c305fa77c034a43077a788738cb73e5cffefec611110ada39c462f8b2835406ee6cf9b7692531bb231ccefdd996dc93b04cf1a6209b3c450d517d82a0f8919176f486ed79c67562b03b978d71604a6a2102cc9d3f89da17f774eac22faa748965753f916a5fed0af2e45895e6bea6563e2d013ed58d97fed5f14e7b27d3e9ef1a51a0c233f2ecbebc8837bedf1f04f28fc2f197d348546be3f03062441b38a8e555164451e62e8e77a7c0828cf76d42116aa83b90d9bcc01ab22cce69bcb005ee7e41911496c4976f4ba9490fe7f3ef574345300f2ab877303c0e5422153a1ef3c9ac06e51a3cdfc6ca15e78e5a4b2133098ee595de494b027a5369ec131b0b62f7178451f0d738401e81b8629161f91b2aea327a785be36d7f8692f01be21e943a768087191a44d175f3fbb62da3989c154d7edee1a86f91d723eb02f6a11d5e4703bf8c9d18ad94daf3fa4102bf57940a37e005a9070552b3b7f7b86105f1d69b3d808eee7fdeb4fdca189769735275f7b7c64da7b7d81aa89cc164ea60d4839557e412573c2890b5d14dcbaf48b5ac880311bdfdd4cffbc09946f9369f95037461637d6e3c9fd7e3b6f665b73cf3833005bac694a7f7a3fcea882293c59164e6500bb13d0ba9f267ae773e631ef335bdda54cbef12acb619e2bd9d98b05281540f89ed6ba9908bed7d014d205b3071ee168e7d98f05cb1586b69947c049954481d382a5e881960e002e64c69357e38dc26730c865fa3d966fcb29a48eda5c18b3b89b8e8d530dea7e896e3774c2a7b955adcfc0a309684fbec2a0a77b475c4d8812591267d3cbca0ce21e71a3e9ea09249ed8b28456de62d2998b0c5de0b97f3b1a3f34fec0e7fdb4af0b33c46d5f0d5614ea199b8b9a327e67c9bfb6051bf7faf10fb8f52eae4d9a67658317e1121854b887f4eac397a0e3882365d30bfba23657cd82350850b834e1aa743a0c097c011a0ed57863404c2a5d6a0ea309278b2d1601ab39faaec0c82c146d8f9f3be66153599593be19b30d2c65b18523944e6701e57b89ddf34edc8b1dc928b402572fbe2c241c78d80bc4fc12c85c9409598327864ac2777f481daf850f1be2603fc73be11e71ea2db9dbe7c930c7f13fc7a6d4b19d11dbeff82affc9a8e3834e916cb4aa46150157cdd0c1abc2d864ff427ac3fe728e9f750aad37a7455a8e77f43be1703da617fa7101aaa3502159195c8269bde5250857c67d59c2a22cee93682362c1c4f33598e066e3b0ca54adb007755f857bbde9a2fa713ac9a4f940c770cee8df293eef4b208c4a97d095edc682534c81587fc31147e088984e5b4d4c9e2137b15df28b338c38b067bbd35876bd550908f6d363b21cedb4d40143cb68a20891f17d28baa5378cde7bba7ad7d99064a378cd581cca77c8e9e7593ddfec157f83e0c2c7899afce34b1f87c279ec486e679410ed1af6147b2a57859894c80ab52f90d1ca3db64ef0a0d8c2683230c540834eb2d81110a8a14ecdfb1ffa4d1d6df393a3c8dd3d8d2404d955ae0b998f890a8a64e01dbf2f9ee594b076e082e1aa629d8e7759b5fcc1467e688fefd2f9c8be8758bf3d25fa9f657137a704e7dbc4b33122e0639fc791a6fd517c89074620bef14f1800201669d51b248cfc6705b4441f2884263861bc12e145eb558d4f8327fa46fc09b95702aabc3bb97ff7ea202bff06ae5d26e3e06c94f52f14cd88b9606cb01dda89e73b43e32c283365ccd13f22a4816d953183b7748b075fc363941749e6abd7083f9ff262939c8df02d49ec976290f0bdae00eb4fbb643882226d4d0616ca1842cfdd8dc05993ccf5ed627d3c0c732d662172e538fb8fc020f521b6dbcacb78fd7e7a040d6761a41892189a19e170f2c41dd506ff521eb448b41e526e1d81bb2c1a1942cd0209b063c84db62ea6dcb929832bb0adf0458039050830ac6005f7a2d2ac47569a4aef2f9a34a9dcf842edf601e168953829e7cb8db0755143fecf5ccac75b4fe1d4ca1a73faca0507506fcef0d81498f3898c3ee2c9b3b7aec8fa31e69863573cd3634ac930f365a15ef77aba02a6fbdd95d2dc7a53de10240f0624a33ca30ec1e4c27cf0eb7a255fe5b6bbf0cbec0d37dad83adb2c57bae08e2468066b4d5b6dcbced0924b744088d5f6f7948a36c2f780620f437acb451626a2379d36983aaa08b1d7a3591eabf9a2fea47a7f454894b209894af66b731070254a54d546e67cc7f86328871234038571b08a5df6bf883f3a357d35916771fd3b6a8d07bc5f3c320ac9c838ff1436a61bb80f6638c9907bf5f9d12fe2c61cc0d3cda4ae833646840d8aee359901769dbb4592728409bfcc7bb5701e825cb5095295974faf64b5337604388144191a203c5c80cea0b0fdec6e5aa37e842ee5250f9f6cd56dc50fd40b6de84466412f077df7f32d17cce72ba65c1287b84b25de83f21a2073dda3e27caea02d8501f088aecdb54a3af48a4aeb099cafdcc93d5f06cc25c5e6119a3441ddef204c803f07c78524184d9347c2591d53b945bb3d928f4efa3f46717b77784d306f79d1f4744d851709cb8e69bed5399004c5cfc9d42be6dfbd627170c718d65b8a190ff57d0656ce0c49d1eedc8b5bf73fd1f9dfda8db14f7dc0895b152f677e69cdf4f861bae96a785677c475b42d36153e16df4ee8eb969c26925d5c71e25c4e6cef394927f4408ae77fc606a502aba51063cdef9b3abf9780ec6a63e40ece0a3764cda8ce706b9d4f02836a7b2b228bef619bd64c5675c39ba2baae5036a85aac2b0b9e4e93cb1d835d0a8f0e117619f0c64626aa50a33a83b116d75b4190bc63b08e12d584d383b6ac068aae095e167fc8ffc0e47994109a1cc855655f0367b4e319ad2ef6a53a5eda9a267224a6a2d7fa493a38ad1d88708966aa0c224e461fe619340d4a50a03a23064d54f2a00e7f9ee1fb98f0c2ba178c722c3ac6240b2925b57f8f1bb1cbcb9a4c4902f302b245fa9e19e60dc21b68b69cbdac1da66b8059cfd6d2223b853fb80abe2472e249aee41b9a99581f03b30180754c588755c138b9ddf2636adce5ba4467e6bcd9c7c27c5f5f937cc986706346be69cd89bed914e93f9f2698b657082ba59862446072a86208125b7827fd8b348e344463229f2508b78e5bbcae8c2b1eb0a721668a21c8ecde6cf3414e54cae2171afd460f1b6764016b3dc32844437d928ccb5f131819bae0a86cd483e76bdf7d8ee78ba22f9ae83c1d654735c1980936af09dd88969a08294c9bcc12ff6dafa6945b680de30602c6312bdb345458b40d061fa9079244c59c26276ac47edd0682fbf420260f702690c84e3bfdafa2d75e35d77500d46684bb4cb5e198dc66ce8e26f1134e338401659f0b260faeaf79f6da00d6ec26beeb5e24cc6181f7bb30820b54e25b1ba3596820b062eb911cc056aedd5c4d258a0ce5c3d120cd4e56825d3d4246f3d7b8fa66b6618813575f40d119610d5bb7b9ee76f0eea35840b31d5b0c17cb11546a0a1df17dd4ce9fc101e9bb6b5aa2387e74f1a225f8e341ea888f930370d2795a1214d2ac7d28cd1ad0871ac6a25773e956ff3c2bd54314afa662a05bd59678e5c18951130a23856ad55ba8b1727a04ca7034929328e2d87c46596d58638ab3a13957bc17b850700afdbdb70a7559d42a2cac17d5665fe66b2f0f4e97db0db820579a21faab20708467b48c5a0a9fee0f310b095d5fd51978f73cbd393e29e4ee14b2b2f2ef4073778d41b2cd94ea487cbf3a13bd939698155a85182946f6d33ff3f9a8756c9ba5fd098475ac6362f9fc9ef159e36b7a770349fa1cd2e88572da0a9c01759dec679a9f845040f58bed75d2e073787df0caf41ceceebfcc8eb4868fc1982b74e2114a7142ceee607af67005a375118087d020364e4143c01bdaf15c66540c01dd9d86516f4b6dcb334fd9baa6909c33ee8c14d83a55a4847c6b5c28f525d4e12c4b40543fc4e4bb473fdaedd3e5c93b07afbaf8099f0cd412a00c81fe904f41b50ef62ced7ad4e284539f7fa64bfe660d1a522217bafe1a90c0382c98e9dafdaba263fdbcdaaeabf42672010007f67e928c4f02f69b17fd3a3ad74b4e705093206d23afa7459bc1d4c4ec17614d7e05eeae221d219c1ada78f14a43f066eef1e8ef4c2361a4c231d93b98dc1a201339eb79ab80047895d372d2208c663f94e11b1c4f627fd291d3bcecf7955651e30d7a523528c676638e2810efda71eb99872ca044eaf7edc5acf34ca0e5b48dfaad6b9d41cd7d96b04a7b1d4fd82554d8fc11a49076e42b9e90e5a6e6d71f3875d94f341fe38eb19260a2ec493f700819b08a4dcce6f29b62ff3b355ad318e4c92c21df699b615690f60fb24af7df51ba98dbc8b1a3b475f9ae0c9014fe24248832829f9686c0f1eba65cdf65b45252c8263427ebda3cdd5d558d79173868c3be1d125a48c69e17b04523d9e8fc5214111903fd62aaaaa80d920105aa0cdee199336b9db37c1cffa9257576fd44d37906cf75f9abe0d42c1273aea21ef75ac6cd4dd8541e5c72f880d0e9f99233fe14cb34a970e0600d5f8335c182042b95c49f69fa93148b1fb910bbb7ab00aa4749402381f1df76da930a4ed7a4cf29ee2e7f301f42fac9032133bc7f3340998e29fa965369a6c6422afa124377bb403209c0527415ee8b93b7142303c0b183d894d66141e9d4a433cfa61d4e17be2ab2e886097b7f6ab9d5b168f1b4c2c51b6c4459ab3e6c51ab6950b60aec80b7ee6df0d14268fbfeffe5f7351589feed7b52312566d008f005d22dbc1ef636990c44ef85b7b34900252fe162d9c1e9a20d5e3ca5ea6952af888a82d2f884fec7bce21c4f18c9bdf66c49b67c1f330e87a99c2d224f4162caa1f7f0e22d7815f6a38fd1df14e9c81bc29ad347a234e7ceb6e034c378f03c51da3720a474f75bfa933af4935ec1f972d7fc255cbd6f98cd529ce657c0d71e42bcd1bb7ae57fa4c262f8c64e2ed1a40e0113f56e823f22e7bf8fdc20681f6c655b6ec5520df717105abaa163e50fffeaab3fd7fd6ce563042280c6eadb6ec3776d5d248ad010fa5508d4bba250b476119a1a965ece2d3df230154c70b3a9bf6a61a69b5d5c3e54a779a966"}, {@device_a, @device_a, 0x80, "3ace42199a32283b59dd4345ede3e6f972e32a83881bbb70d50cb3c70a749befec7fb7648d5e0a3f750a145d9f1005802ff2c192e19e0f1bbcbbf12769c6cad3ed11de1a78e2aacff5a70d9cb42be17a61aae1436589b0470dabcd255fa5eed7e98a92e2973f0ddec948f658f8143cd4a258a0f728d41c4c1f36799e52d5d339"}, {@device_b, @device_a, 0xe8, "65c74edf584da74c0e965b23a31c7f09b75ec319a4ab333619c35d8b9a5ebc7ae1f05b7de896dbfe95c4287d84e32d25691d255d1941865c2af8bc3ec9d854ef953b068a4b0f6f86d60c55ef5ff70bc20dbeefe98f9ae71f30e56f834f97266ee0427c11a59d5114de244293edec2e25e53673fc67e05f957c8ff5a4886d82da57dd8f7eed35a3a3fc462ef0467cf83c2bdeaae37c8be6049761f9d584059a3fa78bdc6df3ada189294b5e6f931f4f5d82db76c96a28f39b671a906f3905a429839560d53629004bd2a7331b7e56619525656262bd6398dfde1d27e07946a21758ee889dc25fdcf3"}, {@device_b, @broadcast, 0xdd, "bbb74e018d75a7ea0e377c0fac5d3cfad23902d1eabebf597d731f89bb2882c18d72c4e0eac5159b3a69f765d7545290edd3fc29ea6d4ac341d956855a26272c914f9ea85a0551217768ba127f8d433f1fb674c89d04f314fa764ad51a350e1800f8f8638d97011d850302e49705c7c75b1c68807c57bc3b2b803fe00803b13f2053a1545fe73f739d64a043b0c8509400e19da824585bbcf6bd80fd9cfc5bfff733d4e74ff4a0d8a8d706890b45199c8554f5a91042ae06fd52d0e006247142e12a250fb7863175c76944daddc2700aaeb6ad2cb01969f97f74634e11"}, {@broadcast, @broadcast, 0x2, "85c1"}]}, 0x13b4) socket$nl_route(0x10, 0x3, 0x0) syz_80211_inject_frame(&(0x7f0000002780)=@broadcast, &(0x7f00000027c0)=@mgmt_frame=@action={{{0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x7}, @broadcast, @device_a, @initial, {0x4, 0x2}, @value=@ver_80211n={0x0, 0x3f, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}}, @addba_resp={0x3, 0x1, {0x1, 0xd, {0x0, 0x1, 0xe, 0x8}, 0x9}}}, 0x25) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000002800)={'bridge0\x00'}) socket$inet_sctp(0x2, 0x5, 0x84) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2000}, [@IFLA_GSO_MAX_SEGS={0x8, 0x28, 0x9dad}]}, 0x28}, 0x1, 0xffffffea}, 0x0) executing program 4: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="680000001800010000000000000000000a00000000000000000000000c00090008000000", @ANYRES32, @ANYBLOB="14000500fe8000000000000000000000000000000800060009"], 0x68}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r2, &(0x7f0000000100)={0x0, 0x600, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000008000000faffff010202001400020065857370616e30000000000000000000090001"], 0x34}, 0x1, 0x40030000000000}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x0, 0x0, 0x8, 0xc}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(0x0) socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xfffffecc) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) executing program 3: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f00000000c0)='GPL\x00', 0x4}, 0x90) (async) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) (async) r2 = socket(0xa, 0x6, 0x0) getsockopt$inet6_mreq(r2, 0x10d, 0x96, 0x0, &(0x7f0000000000)) (async) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2000000011140100000700000000000008"], 0x20}}, 0x0) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="15"], 0x6) executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000095"], &(0x7f0000000280)='syzkaller\x00', 0x4}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='percpu_alloc_percpu\x00', r0}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0x4, 0x3}, 0x90) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c34"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r2, &(0x7f0000000080)={0x1d, r1}, 0x18) sendmsg$can_j1939(r2, &(0x7f00000001c0)={&(0x7f0000000040), 0x18, &(0x7f0000000180)={&(0x7f00000000c0)="92", 0x1a000}}, 0xee) bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r1, 0x0, {0x2, 0x0, 0x4}, 0xfd}, 0x18) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bind$can_j1939(r0, &(0x7f0000000200)={0x1d, r1, 0xfffffffffffffffe, {0x1, 0xf0}, 0x100}, 0x18) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) socket$kcm(0xa, 0x3, 0x3a) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=@newtfilter={0x24, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, r5}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x5a1}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'hsr0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket$inet6(0xa, 0x0, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)="800037bbfa9ba1ce", 0x5dc, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2}, 0x56) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000500)="a4", 0x1a00e, 0xe0ffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x9, [@typedef={0x7, 0x0, 0x0, 0x7}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @typedef={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x5f]}}, 0x0, 0x51}, 0x20) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f050e002be6120306001e0089e9aaa911d7c2290f0086dd1327c9167c64734a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe94f, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: bisecting 30 programs bisect: split chunks (needed=false): <30> bisect: split chunk #0 of len 30 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=20s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 6, 20, 5, 30, 4, 16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x5a1}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'hsr0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket$inet6(0xa, 0x0, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)="800037bbfa9ba1ce", 0x5dc, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2}, 0x56) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000500)="a4", 0x1a00e, 0xe0ffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x9, [@typedef={0x7, 0x0, 0x0, 0x7}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @typedef={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x5f]}}, 0x0, 0x51}, 0x20) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f050e002be6120306001e0089e9aaa911d7c2290f0086dd1327c9167c64734a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe94f, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=17s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=17s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 6, 20, 5, 30, 4] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x5a1}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'hsr0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket$inet6(0xa, 0x0, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)="800037bbfa9ba1ce", 0x5dc, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2}, 0x56) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000500)="a4", 0x1a00e, 0xe0ffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x9, [@typedef={0x7, 0x0, 0x0, 0x7}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @typedef={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x5f]}}, 0x0, 0x51}, 0x20) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f050e002be6120306001e0089e9aaa911d7c2290f0086dd1327c9167c64734a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe94f, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) program did not crash bisect: split chunks (needed=true): <10>, <10> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=18s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 20, 5, 30, 4, 16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x5a1}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'hsr0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket$inet6(0xa, 0x0, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)="800037bbfa9ba1ce", 0x5dc, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2}, 0x56) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000500)="a4", 0x1a00e, 0xe0ffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x9, [@typedef={0x7, 0x0, 0x0, 0x7}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @typedef={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x5f]}}, 0x0, 0x51}, 0x20) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f050e002be6120306001e0089e9aaa911d7c2290f0086dd1327c9167c64734a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe94f, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=18s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash bisect: split chunk #1 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=18s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 6, 20, 5, 30, 4, 5, 30, 9, 2, 12] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x5a1}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'hsr0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket$inet6(0xa, 0x0, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)="800037bbfa9ba1ce", 0x5dc, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2}, 0x56) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000500)="a4", 0x1a00e, 0xe0ffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x9, [@typedef={0x7, 0x0, 0x0, 0x7}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @typedef={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x5f]}}, 0x0, 0x51}, 0x20) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f050e002be6120306001e0089e9aaa911d7c2290f0086dd1327c9167c64734a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe94f, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=18s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 6, 20, 5, 30, 4, 16, 22, 15, 30, 2] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x5a1}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'hsr0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket$inet6(0xa, 0x0, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)="800037bbfa9ba1ce", 0x5dc, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2}, 0x56) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000500)="a4", 0x1a00e, 0xe0ffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x9, [@typedef={0x7, 0x0, 0x0, 0x7}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @typedef={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x5f]}}, 0x0, 0x51}, 0x20) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f050e002be6120306001e0089e9aaa911d7c2290f0086dd1327c9167c64734a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe94f, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) program did not crash bisect: split chunks (needed=true): <5>, <5>, <5>, <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=19s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 3, 6, 20, 5, 30, 4, 16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x5a1}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'hsr0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket$inet6(0xa, 0x0, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)="800037bbfa9ba1ce", 0x5dc, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2}, 0x56) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000500)="a4", 0x1a00e, 0xe0ffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x9, [@typedef={0x7, 0x0, 0x0, 0x7}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @typedef={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x5f]}}, 0x0, 0x51}, 0x20) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f050e002be6120306001e0089e9aaa911d7c2290f0086dd1327c9167c64734a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe94f, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=19s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 6, 20, 5, 30, 4, 16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x5a1}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'hsr0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket$inet6(0xa, 0x0, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)="800037bbfa9ba1ce", 0x5dc, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2}, 0x56) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000500)="a4", 0x1a00e, 0xe0ffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x9, [@typedef={0x7, 0x0, 0x0, 0x7}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @typedef={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x5f]}}, 0x0, 0x51}, 0x20) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f050e002be6120306001e0089e9aaa911d7c2290f0086dd1327c9167c64734a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe94f, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash bisect: split chunk #1 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=19s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 30, 4, 16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x5a1}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'hsr0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket$inet6(0xa, 0x0, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)="800037bbfa9ba1ce", 0x5dc, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2}, 0x56) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000500)="a4", 0x1a00e, 0xe0ffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x9, [@typedef={0x7, 0x0, 0x0, 0x7}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @typedef={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x5f]}}, 0x0, 0x51}, 0x20) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f050e002be6120306001e0089e9aaa911d7c2290f0086dd1327c9167c64734a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe94f, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=19s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 6, 20, 5, 16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: split chunk #2 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=18s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 6, 20, 5, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=19s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 6, 20, 5, 16, 22, 15, 5, 30, 9, 2, 12] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash bisect: split chunk #3 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=18s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 6, 20, 5, 16, 22, 15, 30, 2, 2, 12] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=19s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 6, 20, 5, 16, 22, 15, 30, 2, 5, 30, 9] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) program did not crash bisect: too many guilty chunks, aborting single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$IPCTNL_MSG_CT_GET-openat$tun-ioctl$TUNSETIFF-socket$kcm-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_BLA_BACKBONE-socket$igmp6-ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-ioctl$SIOCSIFHWADDR-write$tun-sendmsg$nl_route detailed listing: executing program 0: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFQNL_MSG_CONFIG detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet_udplite-ioctl$sock_SIOCGIFINDEX-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-mkdirat$cgroup_root-openat$cgroup_root-bpf$BPF_PROG_QUERY-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-bind$inet-sendto$inet-socket-socket$inet6_mptcp-socket-socket$nl_rdma-bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-pselect6-connect$inet6-openat$cgroup_ro-ioctl$FS_IOC_FSSETXATTR-getsockopt$sock_buf-socket$kcm-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$BPF_PROG_DETACH-bpf$MAP_UPDATE_ELEM-sendto$inet-getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE-bpf$PROG_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-bpf$MAP_UPDATE_BATCH-ioctl$ifreq_SIOCGIFINDEX_team-sendmsg$nl_route_sched-unshare-mmap-openat$cgroup_ro-bpf$OBJ_GET_MAP-bpf$MAP_CREATE-bpf$PROG_LOAD_XDP-openat$tun-ioctl$TUNSETIFF-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun-write$cgroup_int-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 1m40s testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 19, 30, 2, 30, 14, 3, 22, 22, 13, 30, 21, 3, 1, 3, 6, 20, 5, 30, 4, 16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba399654"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r0, &(0x7f0000001800)=[{{&(0x7f0000000100)={0xa, 0x0, 0x0, @local, 0x7}, 0x1c, &(0x7f0000001600)=[{&(0x7f0000000140)="87", 0x1}], 0x1}}], 0x1, 0x0) sendmmsg$inet6(r0, &(0x7f0000000400)=[{{&(0x7f0000000040)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3}, 0x1c, &(0x7f0000000300)=[{&(0x7f0000000180)="d7", 0x1}], 0x1}}], 0x1, 0x0) shutdown(r0, 0x1) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDR_INFO(r1, 0x84, 0xf, 0x0, &(0x7f0000000b80)=0x98) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000000)=@assoc_value, 0x8) r2 = openat$ppp(0xffffffffffffff9c, &(0x7f00000001c0), 0x200000, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xb, 0x8, 0x10001, 0x9, 0x1}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000006007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000003000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_free_blocks\x00', r4}, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.empty_time\x00', 0x275a, 0x0) write$cgroup_pid(r5, &(0x7f0000000140), 0x12) ioctl$SIOCSIFHWADDR(r5, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x0, 0x2, 0xc2, 0x0, 0x87}}) ioctl$PPPIOCSMAXCID(r2, 0x40047451, &(0x7f0000000200)=0x5) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000080)=@assoc_value, &(0x7f00000000c0)=0x8) ioctl$PPPIOCSFLAGS1(r2, 0x40047459, &(0x7f0000000240)=0x20) executing program 2: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) shutdown(r0, 0x1) ioctl$int_in(r0, 0x5452, &(0x7f0000000180)=0x401) listen(r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=@base={0x7, 0x4, 0x18, 0x28e, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1a000000}, 0x48) syz_emit_ethernet(0x6e, &(0x7f0000000a40)=ANY=[], 0x0) socket$inet(0x2, 0x4, 0x5) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) accept4$inet(0xffffffffffffffff, &(0x7f0000000440)={0x2, 0x0, @multicast1}, 0x0, 0x0) syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r1, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x4841}, 0x4008040) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) sendto$unix(0xffffffffffffffff, &(0x7f0000000000)="ba", 0x1, 0x0, 0x0, 0x0) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_80211_inject_frame(&(0x7f0000000580), &(0x7f00000005c0)=@mgmt_frame=@deauth={{{0x0, 0x0, 0xc, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1}, {0x7fe1}, @device_b, @broadcast, @initial, {0x6, 0xff2}}, 0x4, @val={0x8c, 0x10, {0xcda, "03ea8fab3993", @short="8cdb61da7a44de6a"}}}, 0x2c) syz_80211_inject_frame(&(0x7f0000000600), &(0x7f0000000640)=@mgmt_frame=@reassoc_req={{{0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x1}, {0x2}, @device_a, @broadcast, @random="63be324a0fcc", {0x4, 0x5}, @value=@ver_80211n={0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1}}, 0x2401, 0x400, @broadcast, {0x0, 0x6, @default_ibss_ssid}, @val={0x1, 0x7, [{0x2, 0x1}, {0x30, 0x1}, {0x5}, {0x9}, {0x48, 0x1}, {0x1, 0x1}, {0x1b, 0x1}]}, @void, [{0xdd, 0x3b, "594a797e30d1dd375a826be7e47ace4143197d9dc217675a04b829c465bdbe8c762478c852e9243a0ba66925b9c9ff47ed51466d0664f9bd5263f5"}, {0xdd, 0xff, "dd562850524ad635e5eb558ef673b7411f02bd1a6bc1bb95e2a1d5f8c74a0493f26f0833379c597a51ae6c2f8889a2ec01be9e2b9d69873d7cad79eb89ac7b2574a79a7cc8325b1ff4f06d755ee04db036bd30b7865d936a760c92da2f12eea62b8f60338c1edf3073c7b524531180168c354f3bff42c59a1982862cf457164f91c747d22ae23f033246095db6405d4bd2c0366cf6ac7c29840490bd17347141d820bb067b9d5495cedef1c0a43f49a1b3f7d009b43fd65cd37a3c96c8612c3969ce455f32de13388ac2b2f1031a6e5b9b6a05613754c43a5d95121e361a0bd5ab6f11bf7cce86c796142e1ec734ca2213f15f6dd9857b463983529d0cd2fa"}, {0xdd, 0xf7, "e81294f3e1f9c818c01e1cf19b9a56ba8890d432f9e71fbd63d06d50e4b37b5b88e763bfce2be85bbfa09a761419c89611f63a7fe6356de1968268f52707635417f856a5ca85c34bf46db4edcc493cd1ecfa6ba1df0124ce54310e1ce673779bc2151777d04de6ecc7a53f8776f191ba3a99c62af3223200a317ffce555f80c2c258b86e221aa527bee3791317fa2cbdcb6f8c157bd55710a4d69784b41ead2b0acb63aeed98d39920484189a1a88580bf1ec5ade86362080b9f62720daf77e552b68dace1797e9eeb161322fe7c91bbdbe7f341b94ea217d1cadcb060901cf3084f0a69c2894ecfa850a45a2bd5f89e486fe7cb6fbbf5"}, {0xdd, 0x96, "5a14f31bed0c4d8268205654d3cefac1853382a597e60f54bde924024e43057259baf30ca5af04020e0504d61f793fceb851cbb2f4bf74068425d73686ec13e8650034d3a63fba8abe8d690a6f798800a821be264e50a55d655c0ac34315aeea1a81ffaaa065223e4442d7c5ed7a5c4aa5c55d067635b52dd7d20db2efbce48fef431b686199ed723620a545d19f302ba1a2bb561d1f"}, {0xdd, 0x1a, "3fab9fc81e124890f4388ca2c73a93a2e7356fc6c58603b6e534"}, {0xdd, 0x92, "e29028f61963a56574505b2f2fcc37e5b44c3da5dd5b2b182d5eb0e38899e4c62151f85246fafc04cae06e2a719044d98e05c93345eb94ac75870a39fc32505360fefc8793468ede8cc085169b04f6b3a5c40c3b613d99e7a85a3ba3b6a712be1502c13e7d2acf0f64c223b16cec73dd454132d022aec40135098dc8168e76ab113c56d240616c319876e9c4277622067ef1"}]}, 0x3b6) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f0000001f80)={@remote, @broadcast, 0x0}, &(0x7f0000001fc0)=0xc) sendmsg$inet(r2, &(0x7f00000020c0)={&(0x7f0000000a80)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10, &(0x7f0000001f00)=[{&(0x7f0000000ac0)="21c9a91eaa341744058cc56feabc8bc6365d3e755d8ec1a63581e95a3d1af795209c58ac879ef4fa08f844004f6c0bb4d7d221c187727e7b7631c8105cce2f2c2d0642095ca71edac01b6dec21bae844f386259e4d0f491a1b45089dfc39820c0bbf57a95d5b1ec3ade91f66e0ae27ce4926be2085b5d26a71f49fc346a5870bcd48522d8d6474a3aea2b8fbc9ba2678e5212dfea84fc539", 0x98}, {&(0x7f0000000b80)="c4c695cb11baed5933827ffb1ca5185c8e3114823cd0159a1f156b7565bc", 0x1e}, {&(0x7f0000000bc0)="5600b165f0104b1154128715b5668fa77088849bc95548278d358b20237549a416e1768d84cfc2c206682b04fc75144870c21f031b673c6e98d605a13ec5dc84e22197c27f3ad70322bafd4eb65a27c58caf68cab9dfeff76f50927da10f4f098599a7a6483507deda80cc06e80c46d6d49a659c5b7ea3cee13ccccbcc15ab33bc34fbfbf7f23a835a74e4b59c1c7699b08cfad0cfe85d5f294a07e01a6cbb350a340378392c12c76588a3eb0251b5cf63823d39f140aa338840ec47bac74dc4cb55ff82fe79f3f605390110104f50cbdb740437ee56e237f4afb66df6f59db4ff949a95a257b272d736558f6cc9d7b3703b1dd54bb620a987e27ef7a3395eea6dbed507526c1990d3bb2f82a11e8260caff5aed08a7b85ecf6a14495432915eb7d54ba74d3641bc04d377bef145240da54bea03569b5e396d17a581d73dd7807a083808c742dd5e7417c7daac2b332639edfcb4f3a3839b09cf4e0d898bfdb688a3443b6c4987152ed38ae3c3f7e22b0cb963835c648c6b07cf773e431203c9261f640126d45704cdfd55b971ca0bb9e11ab301ff54d63af5ea9dd6d2f1309c00d2241b9978070794418e0c6cdfdba5f295fb39d677a27055272ed86cebabf3ea5a185dd54aec32d27c3af440ffc89d31d609d7551f3a7a6884b57841d860ad9a0ba1313e305f3ede1289778864e1bf6fe7d88e1bc8f50081205171d47566d4ecf3482994a2607e05a5a62ce1c39f3f99948c1e2e118d9e46a626a17741e1c906510a27365bd545c3440dc2ec0c2d5a18dd4d30c97a34e90bca0cfaaa0f0aeaa3715da5f1afcee0b968334b9a33cc0895fc45091d6262f3c9ea7d841e730e8a27eb52edc43eb4d7ad91e4037418336d3f0c3e0d90b570144bbaf4ad590c9cf80c8347e8531f2692d433d474b4585b738b45227f686242f0dad29f947f4e4eedda78dc333cd658f9f4f3395431fab7bc4c699cdefb8970775727be2f1cbce8603f9a3c436fdd567cf0222d17e5b3c27f8d4ff773db7919cd6f9e48070aeb3285d12dd100ca8fa395ef4d395195b771103994db70199b908988e5f3a3e34399ebf4726011bb2e8f5b88240b54c28945c957292c3a693fd6e8bff1ed61f32f886a9499178a97210793d847b636f1c80cbd3d0a89f97d1993c9f47ab104b889c12deeb373f0877bec0b20615979c482c27a26c047a85b115956c33760d684f91e39c66b03977637f236aef96c1ea2a0d4d88a81d95b947d9d8341c1da38360576ea428ab38c44d27175e8c279e5f37e1a4244f7879d83b15994a97ab5abb18bd9d57cc44eeac145c1b607a2ac4bc0b27488dad72ccfd6c07162c84200c2df2eb03f5f90a40928829f9e4ae10a8126fee7f519a21d99a8fb495e4c6761702ae97ce99ff1501e47337de7cbc457b9d215a5149f852fd155a0c998808d230c43c55472e35eaf75e821a325ca16f26083bee98c81efac36895d9ee582b7fd78406e7c2f246f8702855572a865fae62d60bcccb9419d706caad29c70178dc0f70e5175a6c8de3bc729dd5772dc7ef1396899493115c7418eb97d7b6e2c72d22def2a56af6d6fe9db4bbc905efb696342992338b8ce538931a803d638dcd49be4608469da2995a90fb769c260c74f84c64563608fc890bb7c0778bc7d3ff5bd23f5fd69bdb3a19c784c529212fcdcc54fdf7d946fd1c1ce6c4c24398ba18426cbbfce3d9c732cc4f10e8a971ff3ac4675db129bf04c9e9e35bf9897ea593e8f648ec2f7f479608a70b9cf8e1e9120db15c9855d082fc170b9808a2358b96a59d60720027f8d7cb86ba7ae99be8bb9e15506fa82a0db803dabff5898fb4c88460e1d6b1f2826be331c14e0da8e08afcfe32c02ee0a7e1ce2627b9f23e146ad01f01992419ee6139e3afc4d678bbd51de55af7f62af3ba44e5563ba66df58d021d47d02853da476d9fcbc49d8049238c694b734f4add99aaa521b21a54f50e9ca5771218ecd51e5de2153b096ae80930a8cac6d41a7e4b28e27284a33b7da78543c5006914f433b8143f8f484dcde986e81a5b8788f7efa49f88aa6a8564a5db34a48fdb75bdad55944a43e5ae7840da3c96b93a7c71e4c87596eac0dd9e0cde47c7b52fcde7a002be208300e7facd22482e2a9053bec00fe0e221263379846cc8ca1a25bd9cd7dab32ff41402afa66b619897ca9dc57b94c8f2b181061008c7cc083b73ae231808a652d9ef7e2dd570a6d0d046139cb4457dc175e3e26f66a20f9cca9ec8dfccf3a2995f886eea69e67d305bea7e02415e4f4dac6e6e718e15d211b03f2460deb19377606df30f64a30a493678f072d50ad625a5b2f5bbc90b107033463181c609c2fa88eca0a4936172b133edbd06ac15288f3ef20ae3c418b19de22130a85207ab80580bd0f36ccb2bdd69938a71684ca3ac17462b14fb0c65eacfc67e6ff67d694b41a05a4bfae9f4c6e81b685ae630701477a7737bc1ff2034dd56ed05cc75c3fc2310cd528659429e0dbe2c56f367d325bc4ad4e756af619804b67b8dd88784b61b52560145e96ab0a36112d9b9beaf85738cce2ae213175e7c7191d091bab5a19c337040e470158d31fa78781cfb649fec58951216cbb983004f9da9a56b510aba67dd047d17fe97f29b21b4e6c88bab3b8514058ff756ff4083e345ddd818ba3748472a1fa37641c9da4cdc64a9618900e012bb93d594d10b38fb5c5616cc24334ea370a8b73dd09f13fe235ffc317cecb6f11b74a2630be55ddc1e409fb4fd65a7bdeff1a963a9941d14faed475dd726b6015df57a130bf5cd7dc1def8187839978f5e915457e92a0aa4180a9baf2b65a69558e8a05116efc4e076b8d845ab2dd29f8cac6ac9f708f7c5283ebef8589f6e9e74e7da1e430712a2500f17a7526dfa18be7e3eb9cd1f8dbe5b2268102f10a0b70bdc7a8dfa9c191eb03f4df8e37b12051f051ea9d098e8e376991741a06279c18d2f2c37caad0fe2287acb2be790c45362445ef9d423540e5db9864d8230edd1516135e208cda037f98fa9f87fcf4e34ca60e18ffec9de595eea96cada4b4d585ff1ebbbb1b577fd54e50afc4b788f1de83c3aa665271ec5bfa1c3d8420815ae0a12b854087f57e3bb26f28580f55ba15b01f1e2cef653601d7c8fdd615bd4294c05d3cb13e8b87de3ac80bece4529c576010fb35974e63052cca52dbe2b3f535859a1d48b3f5b9c7a11cd963808164b38ca5b5194f4acdb9c9bd16784ad28b653955e08ac184990273fea3f40546051fb4003a787e681841a9cb2c3be98890f03cae41979839deda4d89bb361df7afcb1e5d1416605f46404f0af62708aee9dc71e2543873775febffc6d0374c13fdc57d661ca3588d956e5804de0d83275bbaa01a5f6fe9a9ed1d6e53e3c68d496ef174acbf69579d089f1a83f2f6c0c9d6916dd78400c605baeeb19a048670dcb8e4cc01768edac3de00a5049aad8940d9134b3e5cda6b4c4c87b1af2de92a9d51a2b12114046a3911cda83a2adc1161951214258e12342d9993de5954a14a9a30e38ef7c1584ee3584e29d0e19bfae57e5694b95e0ce826042866998c9510cceaffc0f8782639f2d8eec66433a72fef931cfdb3d6736e2c0cb1c2c40decd2c5b18b7fd09079cb92d348d6e9db1660655ce5775530f9d4564536302b52b0d5627d7a06812cd438437a5e84087b7290864c3d55246e8213af66b1cdd465a80532a6b3a31d81c5c7efcae3d7ee4b5a2d36fb4b421f4b4d1582b2965fd27904ed24b2429d8cb63167c48fa044ef56d5d199b92cb91c8c692ae8890b94fa1129a8e01ac6e258758d8f553c248026b40bad0df58ad78f7e215ed9e565ac57c314bace76fd583adc9e0fab31271f168751f808b368b61042a1df6db8aac747c227d1f5ad3b212d247ab019c3873c4b06f955201f2f0249b3ddafceb8a79fd8949824ecc401193e20b17ed581ff45a41dad176bac8c2a4639ff1cb82d8a5eefbd43fce904433b1cdfc5d8a52ee37ac09b22aa145a72e9bc81ce0453710d11e2d5bf69fdbdbcf5738ac748375b710083073563ca98031423c9e0caf10a1c7b5d6bfcf4f43ad8e20b3ebdcce0692f6fe34caf7b9197e00983a7434961f23de17ae251a13355af4c7c97cab62ec35c618b0d638c7e15eef1df234f6a469edc29ff2673cc8064d889cd33edc87129d8158a221ad891bc8ba93791e804ef403beb505d001eaad272f1f333d6aef4473d698a65463b15881717b8a9c547fcc89f7b03dc159a66fa27157579993ee70dd32db93e82f0a8861b13a52eea7f6b08742140d177d60d05eb3079d88da08dce5eac39851ed9fdff0f4075188cfdca5c32af728d484b680d5eae3f4aa3382d85d6c589cccfa491fb1968c92f14f372380d3ccf62e6bddaf8e86aab14d0b15da19adef27ed0a5e7535176537f73ee4d60c20b8d1917014dc958fc8d4a03d2a2e0d080ae049aeb8711378bb97fadead9922cf47dd01f752d1d17b099fd73d51caac926bd9142b7fd18cd047d766c21fb64f487b43be3c60af81b701eb45c92e5a522e5a572b6fa19bdbafdf850469c2f23f7ad7a33274c7f455fa92afc59d7ced2172937aa8b3719f615923d414859618aa710e38e536aee5826a3cee9118ad79d0d8fd1d8adaf5493b344a1dea382c8f2a1ce3ee3e7630b6f69738832bd3fbc90889ad64c7e84cb98dc7baf9a366785f37ab56f4d40ed4ffb584a1c1328372ef27c4836c38551ffd1c36ef0e02911f1d84c1e88b09dc451cd1d468d44df2db6fa755843c9b707dc09fa321d88c49e6a054072738ba2bc69e86c8f9704fd49704ca567293b3083aedaf49e358c67bb002c3ebf3ef20184f0cb4c546b7f585218bc0ded90a07a34cf9f06d3326801c6462abbabfb7cfb4074b90d408f45bfa37c6d65788fe99fad5e0d0d3f3afe7e4d9c01207f51a167ab34f2a0c63bb61d27065f93dbf92aafb9e45f4fe3506e46bbca0cb4920c884bbe8cc942912907f8761dbdec331e471bd17fdd4906c71d545829b4c60db545a52d142d1d81778ea714aba0082cf158bb791f9618a0057037ad80f87bd8f8d76a29563e8ad0ae85492aafc35c051bb5895575671310f3e25b2500ce6e7f254c5eec4b26e639e7891f111ec505065c0ba0464a6ce0c27478c34b362b1cb629ba9fc50cc73a730aab29516dc8b179f89164a0bc7828e1a82302c8a5a3fb18f4718799900c8834e9d8c59541d6f1c78b0d96937f0a3415837f72ca8b26f9dd4f775d552cb80ab1e8021a5f68e109ae29cc22e293c63061c003330d043f78f391a7ebed77b7099a893dd0202d6d82cf84ec8defbc6c7e5946e8a0f6ba325410ab19a0dcd6fb0fe9e0c4436365933271244f4049d75acebf089528f4db1245a06f010d26ca9b4d67ba23af39fd4b996c7f6c40beebce2a15d1be2bd638a34e836018a53abf7f3f439d5e48067f9822b283830e841f6cd0c711f7dfaab556d440946e2077ae9c0ae1fa056c32c20d5e3f57d3fbb280ff6b88188b0ce704c09343e9446eacb5b4e068f532b780dbbec6f202a83e6b5de843ea0e4112af44e87e20c7387eb49b15c245f5d05b31bb21ec32dc7ac3866a547b791513e9b66d8ef47a7829d1e8609d50c15963ad29c5007e3ca6067e395e27eb2739aca18564a8547c3acc898bcbff55c766be4ca459aaa6a22fc22a99c76b563e27f1f9d14d6c2dc0c186707dba08c0e9d89e3bb9b2c71fe4b0264d6f7cdccf4152e18b8a8d213f2eed1f8fb503e59b5d04c739a561408ad58a0eaf6b33d8da876538704c3b1ecb", 0x1000}, {&(0x7f0000001bc0)="1875b08c9565cbeee53135cb7e48ad0fd189990e6290b1e3191212332b2e3bcf429b4e62fdface0a6dfc68a189f387b0409f55f7a3d1ff4e5d95e6891a1485fd0110df9d80e216bfa0b7880cec849ca4bd8d43ce55e5d82ddf38785697bec96dd195a9e7b8f170586bc173a1ed9ad5508ef41baf25b62750f55cff29a1117f3b660fad518e62023524077c72945185196f1c554060c5391daee355e1b7a7f646cc8b01999bf6d263fd0f4e15224c0e9f6c4504f4e1feea6887f24755c39b14b65bbba650a03f17ec863ba73f34b9ce5819f087ee1e44694b69c6dfaca46f5b0d7b7a28868db744", 0xe7}, {&(0x7f0000001cc0)="6b97d069fa0f02237b33465b6138d43ee4da341c7c75fb26233d7364c536599ebabeee50d79ad6d4e22ee6db4e6ce49f6489db2a614deca885a8f84255f5477ea645a44f7e7b1819f51c210690f7fe490fae42f9f495d60b3ba35e5ef4af885be180f59a80c6bbecdf0ab352a04296d85bd68f4d9d42df7d0c8312f24420335fd09a091b42d8f1f1017aaecae84f02211847e28208f6c83c9126901fbc9383b8695e69f9e57beee70e18d9a6ee0f1d28c710b67e95f3c525d036a955f8f19e8aa21bd4b94f35b129744483a937e51242f7cc36ea858c54075ac739d6cf469a421334889f15d73cc61021c9b65300a3f3c99cb9", 0xf3}, {&(0x7f0000001dc0)="417a8dd8b078a717752ec75ee84a75da47daa213aec763e5f1a69bbf130a35839bcd22d1faad19addc2ee88b7c63dfa70fc291797c9a55bf07a60ae77fafd6481891dda218bf798a269766836e8c50afbd688454ea4a24e080d4a0e673926f0d311bfe907a26ceca9c608a9a83cc07a3000ae3152bc49765fcc47aad6b0382983b6c79746f7f408673cba3d91e3d5c6fcb788c6f13c4d65d334592fbc944ea85", 0xa0}, {&(0x7f0000001e80)="ff747dd4564c6bc2a23a693249961d3435f7906e1a286a418472eff6e68bce848ffbf0668ec7a535b4945323538108f3261c8282d72917e03ad99e2621ca5a112d36f401a3a685e4e5670b3a14816fb6807e61", 0x53}], 0x7, &(0x7f0000002000)=[@ip_ttl={{0x14, 0x0, 0x2, 0x7}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {0x0, @local, @local}}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0xb8}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r3, @local, @dev={0xac, 0x14, 0x14, 0xc}}}}, @ip_tos_int={{0x14, 0x0, 0x1, 0xbd}}], 0x88}, 0x20040000) r4 = socket$inet_udp(0x2, 0x2, 0x0) getsockopt$inet_pktinfo(r4, 0x0, 0x8, &(0x7f0000002100)={0x0, @multicast1, @local}, &(0x7f0000002140)=0xc) syz_80211_inject_frame(&(0x7f0000002180)=@broadcast, &(0x7f0000002840)=@data_frame={@a_msdu=@type01={{0x0, 0x2, 0x7, 0x0, 0x1, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x6}, @broadcast, @initial, @from_mac, {0x9, 0x2}, "", @void, @value=@ver_80211n={0x0, 0x7, 0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}}, @a_msdu=[{@device_a, @broadcast, 0xf3, "5211ccb16bb9380ff226e84e2637ddfc58611c368dc46ab8ea3a91266a27c87880d34495e15d737d547d0f48f04e7a1d25f98544031e5a3ab60ac521ff0f4260e4d11c252b5eef9b21f83061339e686141ba1e7b744e79d1013011f2842f6d0022ad362896c230db53bd7c738810249c679957a4d1448aa2213c6ea7883bc5b58e62a57825be64d192b43cfc6026d658ecd158efd15369e857dcb21bf48212e1d800e1ec43ef5b858c36ec0eba2b0f9410a0218c97fb8557998de584a7950511012b072bb989107f48d13397ec258e4811633ba5546b9bb6ac8311b332093f6f65f6ff8ee69e02a1252a3f41c2e3b7979e5a81"}, {@broadcast, @device_a, 0x1000, "1e430a00904481ab069b7645f9b1703a70f65182bc503084faaaf5ea36a0503b7da9177eef0eba3c064671c85267d20680760e206e0d129dd88dc1b1427e53b4c53106f082231b712090b0f7cb00e8b21f8d3571319b914e997d3913ef5c4b3b15caf3dd5dd18343c6fac3762a92a06370376e6065af5151ee42b1984405f070bac97c9493013fcab743fceb9d2c2fc48992a780c2a68d3269abe6a7781c0f7f93a073c3f88bd7b10448526e0752778833de6a4172c051d1a30ca96b6bde67c7d715fcda27cce51c6c602933369282f308ff0037c602affa5a76c7a2ac3f1bef6049cf6452dd549c8ddfc923286bc3d57eb0fb5b868cf03a23e2d673ae2d371ae8091dfefff408764dbbd6db160fbc9d1e34d04110f3a57709000f4ae71e59ae43b7bffc6b5f36321caea5aa0a48232c1d9257542b7a006ce2412c4f56385ac31fd324cec5a600962332fcf6c133aca7bd82eaa97044488d85e920ccc34bd5c7ee814ad3102f8fe360662ea4cd276b3e62fe181a143acedba5e231513a944b8a9d015ed9882d28d12532d792f6b88345edca126de20d1e64c33c870009f867e6ce4fb3a7900507720386d0120567b73178c401a76261ec186c22c3c6bd812478b844d0ee70dfc1747ed9343f2e9cb9ba85538885ea4c684db5c305fa77c034a43077a788738cb73e5cffefec611110ada39c462f8b2835406ee6cf9b7692531bb231ccefdd996dc93b04cf1a6209b3c450d517d82a0f8919176f486ed79c67562b03b978d71604a6a2102cc9d3f89da17f774eac22faa748965753f916a5fed0af2e45895e6bea6563e2d013ed58d97fed5f14e7b27d3e9ef1a51a0c233f2ecbebc8837bedf1f04f28fc2f197d348546be3f03062441b38a8e555164451e62e8e77a7c0828cf76d42116aa83b90d9bcc01ab22cce69bcb005ee7e41911496c4976f4ba9490fe7f3ef574345300f2ab877303c0e5422153a1ef3c9ac06e51a3cdfc6ca15e78e5a4b2133098ee595de494b027a5369ec131b0b62f7178451f0d738401e81b8629161f91b2aea327a785be36d7f8692f01be21e943a768087191a44d175f3fbb62da3989c154d7edee1a86f91d723eb02f6a11d5e4703bf8c9d18ad94daf3fa4102bf57940a37e005a9070552b3b7f7b86105f1d69b3d808eee7fdeb4fdca189769735275f7b7c64da7b7d81aa89cc164ea60d4839557e412573c2890b5d14dcbaf48b5ac880311bdfdd4cffbc09946f9369f95037461637d6e3c9fd7e3b6f665b73cf3833005bac694a7f7a3fcea882293c59164e6500bb13d0ba9f267ae773e631ef335bdda54cbef12acb619e2bd9d98b05281540f89ed6ba9908bed7d014d205b3071ee168e7d98f05cb1586b69947c049954481d382a5e881960e002e64c69357e38dc26730c865fa3d966fcb29a48eda5c18b3b89b8e8d530dea7e896e3774c2a7b955adcfc0a309684fbec2a0a77b475c4d8812591267d3cbca0ce21e71a3e9ea09249ed8b28456de62d2998b0c5de0b97f3b1a3f34fec0e7fdb4af0b33c46d5f0d5614ea199b8b9a327e67c9bfb6051bf7faf10fb8f52eae4d9a67658317e1121854b887f4eac397a0e3882365d30bfba23657cd82350850b834e1aa743a0c097c011a0ed57863404c2a5d6a0ea309278b2d1601ab39faaec0c82c146d8f9f3be66153599593be19b30d2c65b18523944e6701e57b89ddf34edc8b1dc928b402572fbe2c241c78d80bc4fc12c85c9409598327864ac2777f481daf850f1be2603fc73be11e71ea2db9dbe7c930c7f13fc7a6d4b19d11dbeff82affc9a8e3834e916cb4aa46150157cdd0c1abc2d864ff427ac3fe728e9f750aad37a7455a8e77f43be1703da617fa7101aaa3502159195c8269bde5250857c67d59c2a22cee93682362c1c4f33598e066e3b0ca54adb007755f857bbde9a2fa713ac9a4f940c770cee8df293eef4b208c4a97d095edc682534c81587fc31147e088984e5b4d4c9e2137b15df28b338c38b067bbd35876bd550908f6d363b21cedb4d40143cb68a20891f17d28baa5378cde7bba7ad7d99064a378cd581cca77c8e9e7593ddfec157f83e0c2c7899afce34b1f87c279ec486e679410ed1af6147b2a57859894c80ab52f90d1ca3db64ef0a0d8c2683230c540834eb2d81110a8a14ecdfb1ffa4d1d6df393a3c8dd3d8d2404d955ae0b998f890a8a64e01dbf2f9ee594b076e082e1aa629d8e7759b5fcc1467e688fefd2f9c8be8758bf3d25fa9f657137a704e7dbc4b33122e0639fc791a6fd517c89074620bef14f1800201669d51b248cfc6705b4441f2884263861bc12e145eb558d4f8327fa46fc09b95702aabc3bb97ff7ea202bff06ae5d26e3e06c94f52f14cd88b9606cb01dda89e73b43e32c283365ccd13f22a4816d953183b7748b075fc363941749e6abd7083f9ff262939c8df02d49ec976290f0bdae00eb4fbb643882226d4d0616ca1842cfdd8dc05993ccf5ed627d3c0c732d662172e538fb8fc020f521b6dbcacb78fd7e7a040d6761a41892189a19e170f2c41dd506ff521eb448b41e526e1d81bb2c1a1942cd0209b063c84db62ea6dcb929832bb0adf0458039050830ac6005f7a2d2ac47569a4aef2f9a34a9dcf842edf601e168953829e7cb8db0755143fecf5ccac75b4fe1d4ca1a73faca0507506fcef0d81498f3898c3ee2c9b3b7aec8fa31e69863573cd3634ac930f365a15ef77aba02a6fbdd95d2dc7a53de10240f0624a33ca30ec1e4c27cf0eb7a255fe5b6bbf0cbec0d37dad83adb2c57bae08e2468066b4d5b6dcbced0924b744088d5f6f7948a36c2f780620f437acb451626a2379d36983aaa08b1d7a3591eabf9a2fea47a7f454894b209894af66b731070254a54d546e67cc7f86328871234038571b08a5df6bf883f3a357d35916771fd3b6a8d07bc5f3c320ac9c838ff1436a61bb80f6638c9907bf5f9d12fe2c61cc0d3cda4ae833646840d8aee359901769dbb4592728409bfcc7bb5701e825cb5095295974faf64b5337604388144191a203c5c80cea0b0fdec6e5aa37e842ee5250f9f6cd56dc50fd40b6de84466412f077df7f32d17cce72ba65c1287b84b25de83f21a2073dda3e27caea02d8501f088aecdb54a3af48a4aeb099cafdcc93d5f06cc25c5e6119a3441ddef204c803f07c78524184d9347c2591d53b945bb3d928f4efa3f46717b77784d306f79d1f4744d851709cb8e69bed5399004c5cfc9d42be6dfbd627170c718d65b8a190ff57d0656ce0c49d1eedc8b5bf73fd1f9dfda8db14f7dc0895b152f677e69cdf4f861bae96a785677c475b42d36153e16df4ee8eb969c26925d5c71e25c4e6cef394927f4408ae77fc606a502aba51063cdef9b3abf9780ec6a63e40ece0a3764cda8ce706b9d4f02836a7b2b228bef619bd64c5675c39ba2baae5036a85aac2b0b9e4e93cb1d835d0a8f0e117619f0c64626aa50a33a83b116d75b4190bc63b08e12d584d383b6ac068aae095e167fc8ffc0e47994109a1cc855655f0367b4e319ad2ef6a53a5eda9a267224a6a2d7fa493a38ad1d88708966aa0c224e461fe619340d4a50a03a23064d54f2a00e7f9ee1fb98f0c2ba178c722c3ac6240b2925b57f8f1bb1cbcb9a4c4902f302b245fa9e19e60dc21b68b69cbdac1da66b8059cfd6d2223b853fb80abe2472e249aee41b9a99581f03b30180754c588755c138b9ddf2636adce5ba4467e6bcd9c7c27c5f5f937cc986706346be69cd89bed914e93f9f2698b657082ba59862446072a86208125b7827fd8b348e344463229f2508b78e5bbcae8c2b1eb0a721668a21c8ecde6cf3414e54cae2171afd460f1b6764016b3dc32844437d928ccb5f131819bae0a86cd483e76bdf7d8ee78ba22f9ae83c1d654735c1980936af09dd88969a08294c9bcc12ff6dafa6945b680de30602c6312bdb345458b40d061fa9079244c59c26276ac47edd0682fbf420260f702690c84e3bfdafa2d75e35d77500d46684bb4cb5e198dc66ce8e26f1134e338401659f0b260faeaf79f6da00d6ec26beeb5e24cc6181f7bb30820b54e25b1ba3596820b062eb911cc056aedd5c4d258a0ce5c3d120cd4e56825d3d4246f3d7b8fa66b6618813575f40d119610d5bb7b9ee76f0eea35840b31d5b0c17cb11546a0a1df17dd4ce9fc101e9bb6b5aa2387e74f1a225f8e341ea888f930370d2795a1214d2ac7d28cd1ad0871ac6a25773e956ff3c2bd54314afa662a05bd59678e5c18951130a23856ad55ba8b1727a04ca7034929328e2d87c46596d58638ab3a13957bc17b850700afdbdb70a7559d42a2cac17d5665fe66b2f0f4e97db0db820579a21faab20708467b48c5a0a9fee0f310b095d5fd51978f73cbd393e29e4ee14b2b2f2ef4073778d41b2cd94ea487cbf3a13bd939698155a85182946f6d33ff3f9a8756c9ba5fd098475ac6362f9fc9ef159e36b7a770349fa1cd2e88572da0a9c01759dec679a9f845040f58bed75d2e073787df0caf41ceceebfcc8eb4868fc1982b74e2114a7142ceee607af67005a375118087d020364e4143c01bdaf15c66540c01dd9d86516f4b6dcb334fd9baa6909c33ee8c14d83a55a4847c6b5c28f525d4e12c4b40543fc4e4bb473fdaedd3e5c93b07afbaf8099f0cd412a00c81fe904f41b50ef62ced7ad4e284539f7fa64bfe660d1a522217bafe1a90c0382c98e9dafdaba263fdbcdaaeabf42672010007f67e928c4f02f69b17fd3a3ad74b4e705093206d23afa7459bc1d4c4ec17614d7e05eeae221d219c1ada78f14a43f066eef1e8ef4c2361a4c231d93b98dc1a201339eb79ab80047895d372d2208c663f94e11b1c4f627fd291d3bcecf7955651e30d7a523528c676638e2810efda71eb99872ca044eaf7edc5acf34ca0e5b48dfaad6b9d41cd7d96b04a7b1d4fd82554d8fc11a49076e42b9e90e5a6e6d71f3875d94f341fe38eb19260a2ec493f700819b08a4dcce6f29b62ff3b355ad318e4c92c21df699b615690f60fb24af7df51ba98dbc8b1a3b475f9ae0c9014fe24248832829f9686c0f1eba65cdf65b45252c8263427ebda3cdd5d558d79173868c3be1d125a48c69e17b04523d9e8fc5214111903fd62aaaaa80d920105aa0cdee199336b9db37c1cffa9257576fd44d37906cf75f9abe0d42c1273aea21ef75ac6cd4dd8541e5c72f880d0e9f99233fe14cb34a970e0600d5f8335c182042b95c49f69fa93148b1fb910bbb7ab00aa4749402381f1df76da930a4ed7a4cf29ee2e7f301f42fac9032133bc7f3340998e29fa965369a6c6422afa124377bb403209c0527415ee8b93b7142303c0b183d894d66141e9d4a433cfa61d4e17be2ab2e886097b7f6ab9d5b168f1b4c2c51b6c4459ab3e6c51ab6950b60aec80b7ee6df0d14268fbfeffe5f7351589feed7b52312566d008f005d22dbc1ef636990c44ef85b7b34900252fe162d9c1e9a20d5e3ca5ea6952af888a82d2f884fec7bce21c4f18c9bdf66c49b67c1f330e87a99c2d224f4162caa1f7f0e22d7815f6a38fd1df14e9c81bc29ad347a234e7ceb6e034c378f03c51da3720a474f75bfa933af4935ec1f972d7fc255cbd6f98cd529ce657c0d71e42bcd1bb7ae57fa4c262f8c64e2ed1a40e0113f56e823f22e7bf8fdc20681f6c655b6ec5520df717105abaa163e50fffeaab3fd7fd6ce563042280c6eadb6ec3776d5d248ad010fa5508d4bba250b476119a1a965ece2d3df230154c70b3a9bf6a61a69b5d5c3e54a779a966"}, {@device_a, @device_a, 0x80, "3ace42199a32283b59dd4345ede3e6f972e32a83881bbb70d50cb3c70a749befec7fb7648d5e0a3f750a145d9f1005802ff2c192e19e0f1bbcbbf12769c6cad3ed11de1a78e2aacff5a70d9cb42be17a61aae1436589b0470dabcd255fa5eed7e98a92e2973f0ddec948f658f8143cd4a258a0f728d41c4c1f36799e52d5d339"}, {@device_b, @device_a, 0xe8, "65c74edf584da74c0e965b23a31c7f09b75ec319a4ab333619c35d8b9a5ebc7ae1f05b7de896dbfe95c4287d84e32d25691d255d1941865c2af8bc3ec9d854ef953b068a4b0f6f86d60c55ef5ff70bc20dbeefe98f9ae71f30e56f834f97266ee0427c11a59d5114de244293edec2e25e53673fc67e05f957c8ff5a4886d82da57dd8f7eed35a3a3fc462ef0467cf83c2bdeaae37c8be6049761f9d584059a3fa78bdc6df3ada189294b5e6f931f4f5d82db76c96a28f39b671a906f3905a429839560d53629004bd2a7331b7e56619525656262bd6398dfde1d27e07946a21758ee889dc25fdcf3"}, {@device_b, @broadcast, 0xdd, "bbb74e018d75a7ea0e377c0fac5d3cfad23902d1eabebf597d731f89bb2882c18d72c4e0eac5159b3a69f765d7545290edd3fc29ea6d4ac341d956855a26272c914f9ea85a0551217768ba127f8d433f1fb674c89d04f314fa764ad51a350e1800f8f8638d97011d850302e49705c7c75b1c68807c57bc3b2b803fe00803b13f2053a1545fe73f739d64a043b0c8509400e19da824585bbcf6bd80fd9cfc5bfff733d4e74ff4a0d8a8d706890b45199c8554f5a91042ae06fd52d0e006247142e12a250fb7863175c76944daddc2700aaeb6ad2cb01969f97f74634e11"}, {@broadcast, @broadcast, 0x2, "85c1"}]}, 0x13b4) socket$nl_route(0x10, 0x3, 0x0) syz_80211_inject_frame(&(0x7f0000002780)=@broadcast, &(0x7f00000027c0)=@mgmt_frame=@action={{{0x0, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x7}, @broadcast, @device_a, @initial, {0x4, 0x2}, @value=@ver_80211n={0x0, 0x3f, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}}, @addba_resp={0x3, 0x1, {0x1, 0xd, {0x0, 0x1, 0xe, 0x8}, 0x9}}}, 0x25) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000002800)={'bridge0\x00'}) socket$inet_sctp(0x2, 0x5, 0x84) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=@newlink={0x28, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2000}, [@IFLA_GSO_MAX_SEGS={0x8, 0x28, 0x9dad}]}, 0x28}, 0x1, 0xffffffea}, 0x0) executing program 4: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0x0, 0x1c9ae7fffe9a6f34}}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000008c0)=ANY=[@ANYBLOB="680000001800010000000000000000000a00000000000000000000000c00090008000000", @ANYRES32, @ANYBLOB="14000500fe8000000000000000000000000000000800060009"], 0x68}}, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000005c0)) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r2, &(0x7f0000000100)={0x0, 0x600, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000008000000faffff010202001400020065857370616e30000000000000000000090001"], 0x34}, 0x1, 0x40030000000000}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x0, 0x0, 0x8, 0xc}, 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000ffa000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) pipe(0x0) socket$inet_udp(0x2, 0x2, 0x0) close(0xffffffffffffffff) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) socket$key(0xf, 0x3, 0x2) write$binfmt_misc(0xffffffffffffffff, 0x0, 0xfffffecc) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3}, 0xe) executing program 3: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x6, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB], &(0x7f00000000c0)='GPL\x00', 0x4}, 0x90) (async) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r0 = socket$nl_rdma(0x10, 0x3, 0x14) (async) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r1, 0x0) (async) r2 = socket(0xa, 0x6, 0x0) getsockopt$inet6_mreq(r2, 0x10d, 0x96, 0x0, &(0x7f0000000000)) (async) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="2000000011140100000700000000000008"], 0x20}}, 0x0) (async) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) (async) write$binfmt_misc(r3, &(0x7f0000000000)=ANY=[@ANYBLOB="15"], 0x6) executing program 0: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a00000095"], &(0x7f0000000280)='syzkaller\x00', 0x4}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='percpu_alloc_percpu\x00', r0}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x11, 0x4, &(0x7f0000000000)=ANY=[], &(0x7f0000000180)='syzkaller\x00', 0x4, 0x3}, 0x90) executing program 2: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c34"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 0: r0 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r0, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) r2 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r2, &(0x7f0000000080)={0x1d, r1}, 0x18) sendmsg$can_j1939(r2, &(0x7f00000001c0)={&(0x7f0000000040), 0x18, &(0x7f0000000180)={&(0x7f00000000c0)="92", 0x1a000}}, 0xee) bind$can_j1939(r2, &(0x7f0000000100)={0x1d, r1, 0x0, {0x2, 0x0, 0x4}, 0xfd}, 0x18) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) bind$can_j1939(r0, &(0x7f0000000200)={0x1d, r1, 0xfffffffffffffffe, {0x1, 0xf0}, 0x100}, 0x18) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000000)={'vcan0\x00', 0x0}) socket$kcm(0xa, 0x3, 0x3a) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000f00)=@newtfilter={0x24, 0x11, 0x1, 0x0, 0x0, {0x0, 0x0, 0x74, r5}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x5a1}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'hsr0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket$inet6(0xa, 0x0, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)="800037bbfa9ba1ce", 0x5dc, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2}, 0x56) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000500)="a4", 0x1a00e, 0xe0ffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x9, [@typedef={0x7, 0x0, 0x0, 0x7}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @typedef={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x5f]}}, 0x0, 0x51}, 0x20) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f050e002be6120306001e0089e9aaa911d7c2290f0086dd1327c9167c64734a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe94f, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: bisecting 30 programs bisect: split chunks (needed=false): <30> bisect: split chunk #0 of len 30 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=1m45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 21, 3, 1, 3, 6, 20, 5, 30, 4, 16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 4: bpf$PROG_LOAD(0x5, 0x0, 0x0) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce6203c23c00fe80000000000000875a65969ff57b00000000000000000000000000ac1414aa"], 0xfe1b) r0 = socket$kcm(0x10, 0x2, 0x4) close(r0) sendmsg$inet(r0, &(0x7f0000000040)={0x0, 0x900, &(0x7f0000000380)=[{&(0x7f0000000080)="5c00000013006bcd9e3fe3dc6e48aa31086b876c1d0000007ea6020af3653c000a003f00f8ff07001309686ce77df7edd6c3a0e69ee517d34488b26906a247f76c6f8dd5b59960bc24eab556a7050a84c9f5d1938037e786a6d0bdd7", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0x0}, 0x48) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r1) sendmsg$IEEE802154_LLSEC_DEL_KEY(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="fad67003626e51b2bf7a20b901d5910609d2e99c03ade5db317a996eb05df691f98af9af8d287e01f5d0195c616f806fa4d705fc776a5feb", @ANYRES16=r2, @ANYBLOB="010000000000000000002800000005002b000300000005002e00000000000a0001007770616e30000000"], 0x30}}, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xa, 0xf, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x9}, {{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) write(r0, &(0x7f0000000140)="91c9221729d1b6c2ea683a0626152b", 0xf) socket$nl_route(0x10, 0x3, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_SECURITY(r5, 0x0, 0x1, &(0x7f00000002c0)=0x2, 0x4) r6 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='cgroup.stat\x00', 0x275a, 0x0) write$binfmt_script(r6, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r6, 0x0) getsockopt$WPAN_SECURITY(r5, 0x0, 0x1, 0x0, &(0x7f0000001300)) r7 = socket$rxrpc(0x21, 0x2, 0xa) poll(&(0x7f0000000180)=[{r7}, {r7}], 0x2, 0xf49) setsockopt$sock_int(r7, 0x1, 0x7, &(0x7f0000000240), 0x4) bind$alg(r4, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) accept(r4, 0x0, 0x0) r8 = socket$phonet(0x23, 0x2, 0x1) syz_genetlink_get_family_id$tipc2(&(0x7f0000000180), r8) r9 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSARP(r9, 0x8953, &(0x7f0000000180)={{0x2, 0x0, @multicast1}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xa}}, 0xde, {0x2, 0x0, @multicast1=0xe000cc02}}) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r0, 0x6, 0x19, &(0x7f0000000040)=0xfffe, 0x4) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) connect$inet6(r1, &(0x7f0000000500)={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x1c) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'bridge_slave_0\x00', 0x0}) setsockopt$inet6_IPV6_PKTINFO(r1, 0x29, 0x32, &(0x7f0000000140)={@mcast1, r3}, 0x14) bind$inet(r0, &(0x7f0000003900)={0x2, 0x4e24, @multicast1}, 0x10) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000200)={0x58, 0x2, 0x6, 0x401, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x11}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e24, @empty}, 0x10) sendto$inet(r0, &(0x7f0000000100)="f4188a9876a9431deeb98e3edfaafa03a11300e3aebb4102000000000034c5d2af03a5f261a35c07d07d371a4402394549d78c3f511bb4793daf4b4e28410e598769487fb27044ece0b4e738bcc7e1ce3aa7a3df2572a082809f406467bc0f0b47872a2ecc399861b90da1ffcfb35a8f5579b72e3cde817a2a78ff205c6fee57f9177bbeeb2f3d121b9c508660c2d90b0dc3f2412b62e7d99a7dfa6960b663bb8e14764efb33f9465c242b84b75a436ef9af2492b19a15bb9108656d828553e1719de91aa29cb5bf187a0162d50e234b6207725486c9e828d756ff9b6d4f5c4960469dd3a48b4e525f0cbf7158f95d603a37c272f874ee3b5c6e56", 0xfffffffffffffdb0, 0x4040004, 0x0, 0xfffffffb) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000180)='kfree\x00'}, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000440)=@base={0x19, 0x4, 0x4, 0x1, 0x0, 0x1}, 0x48) bpf$MAP_DELETE_ELEM(0x4, &(0x7f0000001600)={r5, 0x0}, 0x20) r6 = socket$netlink(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x0, 0x0) writev(r6, &(0x7f0000000300)=[{&(0x7f0000000000)="65ce1679fef6e81890b6a881167d90778f97b521a1742ba0e9b2f812a012e5b05e08621cc184c8f8dfe61e9b94", 0x2d}, {&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x2) writev(r6, &(0x7f0000000240)=[{&(0x7f0000000080)="390000001300034700bb5be1c3fbfeff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) getsockname$packet(0xffffffffffffffff, 0x0, &(0x7f0000000200)) sendmsg$nl_route(r0, &(0x7f0000000300)={0x0, 0xc3ff, &(0x7f0000000000)={&(0x7f0000000540)=ANY=[@ANYBLOB="400000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="0000000000000000140003006272696467655f736c6176655f3100000a000100be"], 0x40}}, 0x0) executing program 1: syz_emit_ethernet(0x46, &(0x7f00000000c0)={@local, @random="7f0a06034011", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x5, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "000088beffff0000"}}}}}, 0x0) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$kcm(0x29, 0x7, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x2a, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1400000024000900000000000000000007"], 0x14}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000280)={0x12, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1e}, 0x90) write$tun(r0, &(0x7f0000000280)={@val={0x0, 0x800}, @val={0x1, 0x0, 0x0, 0x0, 0x3d}, @mpls={[], @ipv4=@tcp={{0x5, 0x4, 0x0, 0x0, 0x34, 0x0, 0x0, 0x0, 0x84, 0x0, @empty=0x3fffffff, @local}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x5, 0x8, 0x0, 0x0, 0x0, 0x8, {[@window={0x9, 0x3}, @generic={0x0, 0x8, "d58838068b91"}]}}}}}}, 0x42) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7, 0x4}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000208500000001000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007000000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='ext4_ext_remove_space_done\x00', r1}, 0x10) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000980), &(0x7f0000002d80), 0x4, r0}, 0x38) ioctl$ifreq_SIOCGIFINDEX_team(0xffffffffffffffff, 0x8933, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) unshare(0x62040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000440)=@generic={0x0}, 0x18) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r4 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r3, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001000000060ec97000fc83c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) write$cgroup_int(r2, &(0x7f0000000100), 0x1001) ioctl$SIOCSIFHWADDR(r2, 0x4030582b, &(0x7f0000000280)={'lo\x00', @link_local={0x1, 0x80, 0xc2, 0xc, 0x8}}) executing program 1: r0 = socket$key(0xf, 0x3, 0x2) (async) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x8, &(0x7f00000000c0)=0x4d, 0x4) (async) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000000440)=""/17, &(0x7f0000000240)=0x11) (async) sendmsg$key(r0, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x2, 0x7, 0x0, 0x6, 0x7, 0x0, 0x0, 0x25dfdbfd, [@sadb_x_nat_t_port={0x1, 0x16, 0x4e21}, @sadb_sa={0x2, 0x1, 0x4d6, 0x2, 0x20, 0x81, 0x1, 0xa0000000}, @sadb_sa={0x2, 0x1, 0x4d4, 0x81, 0xff, 0xcd, 0x0, 0x60000001}]}, 0x38}, 0x1, 0x7}, 0x0) executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000380)=[@in={0x2, 0x0, @rand_addr=0x64010102}]}, &(0x7f0000000180)=0x10) r1 = socket$inet(0x2, 0x80001, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r1, 0x84, 0x14, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r2, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x5a1}, 0x9c) getsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000002c0)={r2, @in6={{0xa, 0x0, 0x0, @empty}}}, &(0x7f00000003c0)=0x9c) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000140)={'hsr0\x00'}) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000000), 0x12) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, 0x0) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) r4 = socket$inet6(0xa, 0x0, 0x3a) setsockopt$inet6_int(r4, 0x29, 0x11, &(0x7f0000000140)=0x2, 0x4) setsockopt$inet6_mtu(0xffffffffffffffff, 0x29, 0x17, 0x0, 0x0) sendto$inet6(r4, &(0x7f0000000000)="800037bbfa9ba1ce", 0x5dc, 0x0, &(0x7f0000000180)={0xa, 0x0, 0x0, @mcast2}, 0x56) setsockopt$inet_sctp6_SCTP_AUTH_CHUNK(r3, 0x84, 0x15, &(0x7f0000000040), 0x1) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0x12, 0x5, 0x8, 0x2}, 0x48) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000500)="a4", 0x1a00e, 0xe0ffffff, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000004c0)={&(0x7f0000000380)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x9, [@typedef={0x7, 0x0, 0x0, 0x7}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x3}}, @typedef={0x6, 0x0, 0x0, 0x12, 0x1}]}, {0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x61, 0x5f]}}, 0x0, 0x51}, 0x20) executing program 1: r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'erspan0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000040)=0x200, 0x4) sendto$packet(r0, &(0x7f00000000c0)="3f050e002be6120306001e0089e9aaa911d7c2290f0086dd1327c9167c64734a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe46", 0xe94f, 0x0, &(0x7f0000000540)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=1m42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 22, 15, 30, 2, 5, 30, 9, 2, 12] detailed listing: executing program 1: r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000500)={&(0x7f00000004c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x3, [@restrict={0x7, 0x0, 0x0, 0xb, 0x4}]}, {0x0, [0x2e]}}, &(0x7f00000005c0)=""/210, 0x27, 0xd2, 0x0, 0x20}, 0x20) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x20000000000003ca, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0xfffffffffffffee7}, 0x90) r2 = accept$packet(0xffffffffffffffff, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000300)=0x14) accept$packet(r2, &(0x7f0000000340)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @multicast}, &(0x7f0000000380)=0x14) (async) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000540)={0x28, 0x3b, 0x107, 0x0, 0x0, {0x2}, [@typed={0x4}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x59, 0x0, 0x0, @u32}]}, @typed={0x4, 0x8, 0x0, 0x0, @binary}]}, 0x28}}, 0x0) (async, rerun: 32) r5 = socket$nl_generic(0x10, 0x3, 0x10) (rerun: 32) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) r7 = socket(0x18, 0x800, 0x3) (async, rerun: 32) getsockopt$inet_sctp_SCTP_RTOINFO(r3, 0x84, 0x0, &(0x7f00000003c0)={0x0, 0xfff, 0x9, 0x1}, &(0x7f0000000400)=0x10) (rerun: 32) getsockopt$inet_sctp_SCTP_DELAYED_SACK(r7, 0x84, 0x10, &(0x7f0000000440)=@sack_info={r8, 0x81, 0x40}, &(0x7f0000000480)=0xc) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000840)={0x54, 0x0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x20, 0x51, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NL80211_KEY_IDX={0x5}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "adff360dad"}, @NL80211_KEY_DEFAULT_MGMT={0x4}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x994}]]}, 0x54}}, 0x0) (async, rerun: 32) r9 = socket$nl_xfrm(0x10, 0x3, 0x6) (rerun: 32) sendmsg$nl_xfrm(r9, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000080)=@getspdinfo={0x14, 0x25, 0x100, 0x70bd2a, 0x25dfdbfc, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x5}, 0xc010) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x0, 0xc, 0x0, 0x0}, 0x90) executing program 1: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @multicast1}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x20020084, &(0x7f00000018c0)={0x2, 0x4e20}, 0x10) socket(0x0, 0x0, 0x6) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0x28, 0x5, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000780)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000003000000850000008200000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r3}, 0x10) pselect6(0x40, &(0x7f00000001c0), 0x0, &(0x7f00000002c0)={0x3ff}, 0x0, 0x0) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x0, 0x0, @dev}, 0x1c) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x7a05, 0x1700) ioctl$FS_IOC_FSSETXATTR(0xffffffffffffffff, 0x401c5820, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000140)) socket$kcm(0x2, 0x0, 0x106) r4 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000b80)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000295000000000000009f33ef60916e6e893f1eeb0be2566cd0723043c47c896ce0bce66a245ad99b817fd98cd824498949714ffaac8a6f77ef26dcca5582054d54d53cd2b6db714e4b94bdae214fa68a0557eb2c5ca683a4b6fc89398f2b9000f224891060017cfa6fa26fa7a34701008c61897d4a6148a1c11428607c40de60beac671e8e8fdecb03588aa623fa71f871ab5c2ff88afc6002084e5b52710800e835cf0d78e45f70983826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174bed9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632fd30bf05121438bb74e4670ab5dfe447a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffb426e1230bc1cd4c02c4c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd78a9f3fdc1f50c445e3f30e703cf05b90fbf940e6652d377474ed5f816f66ac3027460ae991e7f834dd7a7fc2a7003d1a6cf5478533584961c329fcf4fed5c9455640dcd28273dc9753cc979113f2915a3039c3ca60ec53bb1130c2d27fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc51177cce5ef265c92b7957a334ff7be2ca867fd94286e016febfdb5827efc7a6efb01d66a396f84c1ca75daa4ead099694ed03d449b185cc836bab1a41a61bd6f03a54fafcee554bbb52adf8f1d7ede9f9a711256fb45e6c3d12ff560ee69d68733d522d9bbecf52396f15976381c27015403778139808142b48ced145ca8a6da5f322d413d09cc38b832fa05dd3c799042588f9eea6f443baa759257a000000000000000000bed1dad228e11f80cfea5848e436acf6e89dfae0b3d95b911af1818e0081504811a5f3c5d1ced3e592224f1d2ca3bdb2cc89001605db6987899eb99f94265401a95ff0a5a266438f1db461b7ebedd419bc038f7d36bd2bd4b3f92cd1469b63b1ce456a96152d353a8ab65f8bae521db73ff00b5d5cac7a439ab40d97e57f23e703fd6395930b9c3485ab181a83ed568cade43111530ec584cfb48e0cc5d63e2807b2e98525a84f9ac59cf74f3ba279e228e2a0dc8da8017cba3996541008785ab8f041f0a8d1399d88a3a58765e5a0149b9d0ea54b32"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x90) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r4, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r5, &(0x7f0000000340), &(0x7f0000000040)=@tcp=r0}, 0x20) sendto$inet(r0, &(0x7f00000000c0)='+', 0xffffffffffffff60, 0xf405, 0x0, 0xf06) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r0, 0x6, 0x23, &(0x7f0000000340)={&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffc44, 0x0, 0x0}, &(0x7f0000000380)=0x40) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000180)='cgroup.controllers\x00', 0x275a, 0x0) close(r1) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) listen(r2, 0xfffffffc) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0xfe7d, &(0x7f0000000000)=[@in]}, &(0x7f00000002c0)=0x10) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.controllers\x00', 0x275a, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r2, 0x84, 0x18, &(0x7f0000000200)={r3, 0x80}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp_SCTP_ASSOCINFO(r4, 0x84, 0x1, &(0x7f0000000040)={r3, 0xffff, 0x1000, 0x80, 0x7f, 0x7ff}, &(0x7f0000000100)=0x14) write$cgroup_int(r4, &(0x7f0000000000), 0x12) close(r4) setsockopt$inet6_udp_int(r1, 0x11, 0x67, &(0x7f0000000140)=0x2, 0x4) ioctl$BTRFS_IOC_QGROUP_LIMIT(0xffffffffffffffff, 0x8030942b, &(0x7f00000001c0)={0x3ff, {0x8, 0x1f, 0xffffffffffffffff, 0x58fa1c17, 0x3}}) sendmsg$IPCTNL_MSG_CT_NEW(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="c00000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa14000400fe8000000000000000000000000000000c00028005000100000000003c0002800c00028005000100000000002c000180140003000000000000000000000000000000000100000400fe8000000000000000000000000000aa08000740000000002c00068014000500000000000000000000000000000000001400040000000000000000000000000000000001"], 0xc0}}, 0x0) socketpair(0x2, 0x0, 0x1, &(0x7f0000000300)) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r0) (async) socket$inet6_mptcp(0xa, 0x1, 0x106) (async) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x8000) close(0xffffffffffffffff) (async) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_int(r1, 0x11, 0x1, &(0x7f0000000240)=0x225, 0x4) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='p\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c00070073797374656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000080002000000000014000600626f6e643000000400000000000000000000000000000a00"/106], 0x70}, 0x1, 0xffffffff00000003}, 0x0) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)={0x48, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_REPLY={0x2c, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_ZONE={0x6}]}, @CTA_ZONE={0x6, 0x12, 0x1, 0x0, 0x4}]}, 0x48}}, 0x0) (async) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="460000000206030000000000000100000000000005000100070000000900020073797a30001c00000c0007800800134000000000050005000000000005000400000000000d000300686173683a6d616300000000"], 0x54}}, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$IPSET_CMD_FLUSH(r6, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x3c, 0x4, 0x6, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x20000000) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) (async) r7 = socket$packet(0x11, 0x2, 0x300) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r8, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)={0x24, r9, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r10}, @void}}, [@NL80211_ATTR_IE={0x4}, @NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x24}}, 0x0) setsockopt$packet_fanout(r7, 0x107, 0x12, &(0x7f0000000040)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r7, 0x107, 0x16, &(0x7f00000000c0)={0x3, &(0x7f0000000180)=[{0x28, 0x1, 0x0, 0xfffff034}, {0x54}, {0x8}]}, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000080)=ANY=[@ANYBLOB="0380c2000000bbbbbbbbbbbb08004500001c0065000000429078ac1e0001ac1414aa00009078ac1414bb"], 0x0) r11 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_int(r11, &(0x7f0000000080)='hugetlb.1GB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r12, &(0x7f0000000100)=ANY=[@ANYRESOCT], 0x8) executing program 3: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r0, 0x84, 0x7d, &(0x7f0000000080), &(0x7f00000000c0)=0x8) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <10> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m41s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 30, 9, 2, 12] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 12] detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x4800, &(0x7f0000000140)={&(0x7f0000000280)=ANY=[@ANYBLOB="580000000203030000000000000000000000000208000340000000000800054000000000080003400000003f08000340000000080800010001000023090002000000100000000000080004"], 0x58}}, 0x0) executing program 3: sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(0xffffffffffffffff, 0x0, 0x0) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000440)={@val={0x6}, @void, @eth={@multicast, @remote, @val={@val, {0x810a}}, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x58, 0x0, 0x0, 0x0, 0x2f, 0x0, @remote, @remote}}}}}}, 0x72) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 30, 9] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: split chunks (needed=true): <3> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socket$inet_udplite-ioctl$sock_SIOCGIFINDEX-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-mkdirat$cgroup_root-openat$cgroup_root-bpf$BPF_PROG_QUERY-sendmsg$nl_route detailed listing: executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'netdevsim0\x00', 0x0}) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000000000000000080eff95"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={&(0x7f00000002c0)='contention_end\x00', r3}, 0x10) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000080)={@cgroup=r4, 0x2b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000840)=@newlink={0x4c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x10b}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @macvlan={{0xc}, {0x14, 0x2, 0x0, 0x1, [@IFLA_MACVLAN_MODE={0x8, 0x1, 0x8}, @IFLA_MACVLAN_FLAGS={0x6, 0x2, 0x1}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x4c}}, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 30] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(0xffffffffffffffff, 0x0, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0xb000000, &(0x7f0000000200)={&(0x7f00000002c0)={0x64, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x28, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x0, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @crypto_settings=[@NL80211_ATTR_PMK={0x4}, @NL80211_ATTR_SOCKET_OWNER={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}, @NL80211_ATTR_CONTROL_PORT_NO_ENCRYPT={0x4}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x64}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-mkdirat$cgroup_root-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211-bind$alg-socket-socket$packet-ioctl$sock_SIOCGIFINDEX-sendto$packet detailed listing: executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 1 programs left: executing program 3: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) bisect: trying to concatenate bisect: concatenate 1 entries testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-mkdirat$cgroup_root-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211-bind$alg-socket-socket$packet-ioctl$sock_SIOCGIFINDEX-sendto$packet detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) r7 = socket(0x200000100000011, 0x803, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'xfrm0\x00', 0x0}) sendto$packet(r7, &(0x7f00000000c0)="4dcdc7d96a760000002f00050000000000060000450b21e9e89291df563213e9152234f5623c526156de8ae4ae9150d3d2dd194a", 0x34, 0x0, &(0x7f0000000000)={0x11, 0x0, r9, 0x1, 0x0, 0x6, @dev}, 0x14) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete bisect: concatenation succeeded found reproducer with 30 syscalls minimizing guilty program testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-mkdirat$cgroup_root-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211-bind$alg-socket-socket$packet-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket(0x200000100000011, 0x803, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'xfrm0\x00'}) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-mkdirat$cgroup_root-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211-bind$alg-socket-socket$packet detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket(0x200000100000011, 0x803, 0x0) socket$packet(0x11, 0x2, 0x300) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-mkdirat$cgroup_root-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211-bind$alg-socket detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket(0x200000100000011, 0x803, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-mkdirat$cgroup_root-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211-bind$alg detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-mkdirat$cgroup_root-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211 detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-mkdirat$cgroup_root-connect$pppl2tp-getsockopt$bt_BT_SECURITY detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-mkdirat$cgroup_root-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-mkdirat$cgroup_root detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz1\x00', 0x1ff) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_LINKMODES_SET-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e000000080000000000180003801400038010000180"], 0x44}}, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$nl_generic-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Read in l2tp_tunnel_del_work testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-getsockopt$inet_int-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) getsockopt$inet_int(0xffffffffffffffff, 0x10d, 0x0, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000001010000000000000800000018110090a3001afb0020e20e492639c79cfdd4afe197e6316b542c8b2cd34259bb8caefeb6d1dad65a949af8816d4d22097ae13a1b841e6a84d77c741a86ea7623fbf1108a2d75a68e588ed5e7d632d13b71f739c262b3a0164ab90f46288777e02bfc6cffc393203ea9be07c0fcf9345e6d8d09bfa7972dc3", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf090000000000005509010000000000950000000000000018000000c700000000000000060000008182fe0fff0000001f705700090000007b46f8ff0c000000bf91000000000000b7020000000000008500000084000000b7000000000000009500000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x8}, 0x90) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) sendmsg$NFT_BATCH(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r0, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Read in l2tp_tunnel_del_work testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x90) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$PROG_LOAD-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, 0x0, 0x0) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp program did not crash simplifying guilty program options testing program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Read in l2tp_tunnel_del_work extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp program did not crash testing program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp program did not crash reproducing took 1h22m14.667115692s repro crashed as (corrupted=false): wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in test_and_set_bit include/asm-generic/bitops/instrumented-atomic.h:71 [inline] BUG: KASAN: slab-use-after-free in l2tp_session_delete+0x28/0x9e0 net/l2tp/l2tp_core.c:1639 Write of size 8 at addr ffff88807af2f008 by task kworker/u8:2/29 CPU: 1 PID: 29 Comm: kworker/u8:2 Not tainted 6.10.0-rc4-syzkaller-00869-g185d72112b95 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: l2tp l2tp_tunnel_del_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] test_and_set_bit include/asm-generic/bitops/instrumented-atomic.h:71 [inline] l2tp_session_delete+0x28/0x9e0 net/l2tp/l2tp_core.c:1639 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1302 [inline] l2tp_tunnel_del_work+0x1cb/0x330 net/l2tp/l2tp_core.c:1334 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 5297: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:4122 [inline] __kmalloc_noprof+0x1f9/0x400 mm/slub.c:4135 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] l2tp_session_create+0x3b/0xc20 net/l2tp/l2tp_core.c:1675 pppol2tp_connect+0xca3/0x17a0 net/l2tp/l2tp_ppp.c:782 __sys_connect_file net/socket.c:2049 [inline] __sys_connect+0x2df/0x310 net/socket.c:2066 __do_sys_connect net/socket.c:2076 [inline] __se_sys_connect net/socket.c:2073 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2073 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 16: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2196 [inline] slab_free mm/slub.c:4437 [inline] kfree+0x149/0x360 mm/slub.c:4558 __sk_destruct+0x58/0x5f0 net/core/sock.c:2191 rcu_do_batch kernel/rcu/tree.c:2535 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3072 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176 pppol2tp_release+0x24b/0x350 net/l2tp/l2tp_ppp.c:457 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x406/0x8b0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:180 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88807af2f000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 8 bytes inside of freed 1024-byte region [ffff88807af2f000, ffff88807af2f400) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7af28 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffefff(slab) raw: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000003 ffffea0001ebca01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5210, tgid 5210 (syz-executor), ts 172142307269, free_ts 172127611689 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468 prep_new_page mm/page_alloc.c:1476 [inline] get_page_from_freelist+0x2e43/0x2f00 mm/page_alloc.c:3420 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4678 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page+0x5f/0x120 mm/slub.c:2265 allocate_slab+0x5a/0x2f0 mm/slub.c:2428 new_slab mm/slub.c:2481 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667 __slab_alloc+0x58/0xa0 mm/slub.c:3757 __slab_alloc_node mm/slub.c:3810 [inline] slab_alloc_node mm/slub.c:3989 [inline] __do_kmalloc_node mm/slub.c:4121 [inline] __kmalloc_noprof+0x257/0x400 mm/slub.c:4135 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] alloc_workqueue+0x1b0/0x2060 kernel/workqueue.c:5667 ieee80211_register_hw+0x296c/0x3d80 net/mac80211/main.c:1467 mac80211_hwsim_new_radio+0x2597/0x44d0 drivers/net/wireless/virtual/mac80211_hwsim.c:5470 hwsim_new_radio_nl+0xe4c/0x21d0 drivers/net/wireless/virtual/mac80211_hwsim.c:6151 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f0/0x990 net/netlink/af_netlink.c:1357 page last free pid 5283 tgid 5283 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1088 [inline] free_unref_page+0xd22/0xea0 mm/page_alloc.c:2583 discard_slab mm/slub.c:2527 [inline] __put_partials+0xeb/0x130 mm/slub.c:2995 put_cpu_partial+0x17c/0x250 mm/slub.c:3070 __slab_free+0x2ea/0x3d0 mm/slub.c:4307 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9e/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3941 [inline] slab_alloc_node mm/slub.c:4001 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4008 getname_flags+0xbd/0x4f0 fs/namei.c:139 vfs_fstatat+0x11c/0x190 fs/stat.c:303 __do_sys_newfstatat fs/stat.c:468 [inline] __se_sys_newfstatat fs/stat.c:462 [inline] __x64_sys_newfstatat+0x125/0x1b0 fs/stat.c:462 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88807af2ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88807af2ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88807af2f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807af2f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807af2f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in test_and_set_bit include/asm-generic/bitops/instrumented-atomic.h:71 [inline] BUG: KASAN: slab-use-after-free in l2tp_session_delete+0x28/0x9e0 net/l2tp/l2tp_core.c:1639 Write of size 8 at addr ffff88807af2f008 by task kworker/u8:2/29 CPU: 1 PID: 29 Comm: kworker/u8:2 Not tainted 6.10.0-rc4-syzkaller-00869-g185d72112b95 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: l2tp l2tp_tunnel_del_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] test_and_set_bit include/asm-generic/bitops/instrumented-atomic.h:71 [inline] l2tp_session_delete+0x28/0x9e0 net/l2tp/l2tp_core.c:1639 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1302 [inline] l2tp_tunnel_del_work+0x1cb/0x330 net/l2tp/l2tp_core.c:1334 process_one_work kernel/workqueue.c:3231 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3312 worker_thread+0x86d/0xd70 kernel/workqueue.c:3393 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 5297: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:4122 [inline] __kmalloc_noprof+0x1f9/0x400 mm/slub.c:4135 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] l2tp_session_create+0x3b/0xc20 net/l2tp/l2tp_core.c:1675 pppol2tp_connect+0xca3/0x17a0 net/l2tp/l2tp_ppp.c:782 __sys_connect_file net/socket.c:2049 [inline] __sys_connect+0x2df/0x310 net/socket.c:2066 __do_sys_connect net/socket.c:2076 [inline] __se_sys_connect net/socket.c:2073 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2073 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 16: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2196 [inline] slab_free mm/slub.c:4437 [inline] kfree+0x149/0x360 mm/slub.c:4558 __sk_destruct+0x58/0x5f0 net/core/sock.c:2191 rcu_do_batch kernel/rcu/tree.c:2535 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3072 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176 pppol2tp_release+0x24b/0x350 net/l2tp/l2tp_ppp.c:457 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x406/0x8b0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:180 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88807af2f000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 8 bytes inside of freed 1024-byte region [ffff88807af2f000, ffff88807af2f400) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7af28 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffefff(slab) raw: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000003 ffffea0001ebca01 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 5210, tgid 5210 (syz-executor), ts 172142307269, free_ts 172127611689 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1468 prep_new_page mm/page_alloc.c:1476 [inline] get_page_from_freelist+0x2e43/0x2f00 mm/page_alloc.c:3420 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4678 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page+0x5f/0x120 mm/slub.c:2265 allocate_slab+0x5a/0x2f0 mm/slub.c:2428 new_slab mm/slub.c:2481 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667 __slab_alloc+0x58/0xa0 mm/slub.c:3757 __slab_alloc_node mm/slub.c:3810 [inline] slab_alloc_node mm/slub.c:3989 [inline] __do_kmalloc_node mm/slub.c:4121 [inline] __kmalloc_noprof+0x257/0x400 mm/slub.c:4135 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] alloc_workqueue+0x1b0/0x2060 kernel/workqueue.c:5667 ieee80211_register_hw+0x296c/0x3d80 net/mac80211/main.c:1467 mac80211_hwsim_new_radio+0x2597/0x44d0 drivers/net/wireless/virtual/mac80211_hwsim.c:5470 hwsim_new_radio_nl+0xe4c/0x21d0 drivers/net/wireless/virtual/mac80211_hwsim.c:6151 genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline] genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline] genl_rcv_msg+0xb14/0xec0 net/netlink/genetlink.c:1210 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 genl_rcv+0x28/0x40 net/netlink/genetlink.c:1219 netlink_unicast_kernel net/netlink/af_netlink.c:1331 [inline] netlink_unicast+0x7f0/0x990 net/netlink/af_netlink.c:1357 page last free pid 5283 tgid 5283 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1088 [inline] free_unref_page+0xd22/0xea0 mm/page_alloc.c:2583 discard_slab mm/slub.c:2527 [inline] __put_partials+0xeb/0x130 mm/slub.c:2995 put_cpu_partial+0x17c/0x250 mm/slub.c:3070 __slab_free+0x2ea/0x3d0 mm/slub.c:4307 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9e/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3941 [inline] slab_alloc_node mm/slub.c:4001 [inline] kmem_cache_alloc_noprof+0x135/0x2a0 mm/slub.c:4008 getname_flags+0xbd/0x4f0 fs/namei.c:139 vfs_fstatat+0x11c/0x190 fs/stat.c:303 __do_sys_newfstatat fs/stat.c:468 [inline] __se_sys_newfstatat fs/stat.c:462 [inline] __x64_sys_newfstatat+0x125/0x1b0 fs/stat.c:462 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff88807af2ef00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88807af2ef80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88807af2f000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807af2f080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807af2f100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================