Extracting prog: 1h31m29.939062824s Minimizing prog: 18m46.865997556s Simplifying prog options: 0s Extracting C: 33.294399359s Simplifying C: 22m14.985193476s extracting reproducer from 30 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_sctp-setsockopt$sock_int-setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD-bpf$PROG_LOAD-syz_init_net_socket$bt_sco-bpf$MAP_CREATE-socket$inet_tcp-setsockopt$sock_int-bpf$MAP_UPDATE_ELEM-setsockopt$MRT6_ADD_MFC-bpf$MAP_DELETE_ELEM-socket-socket$qrtr-ioctl$sock_inet_SIOCSIFPFLAGS-ioctl-bind$alg-socketpair$unix-syz_init_net_socket$ax25-bind$ax25-socket$inet_mptcp-ioctl$sock_SIOCETHTOOL-ioctl$sock_SIOCGIFINDEX-openat$rfkill-write$rfkill-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netrom_SIOCADDRT-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private detailed listing: executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 5, 4, 7, 7, 5, 5, 3, 11, 17, 8, 7, 4, 7, 6, 16, 15, 7, 28, 9, 3, 19, 17, 9, 7, 10, 3, 28, 17, 5] detailed listing: executing program 0: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000000c0)={0x84, @local, 0x15, 0x3, 'fo\x00', 0x1, 0x0, 0x69}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000380)={{0x84, @rand_addr=0x64010104, 0x4e24, 0x3, 'nq\x00', 0x8, 0x5, 0x55}, {@remote, 0x4e22, 0x0, 0x7, 0x12d5c, 0x12d58}}, 0x44) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000dc0)=ANY=[@ANYRES16=r2, @ANYRES32, @ANYBLOB="0800c3"], 0x33fe0}, 0x1, 0x0, 0x0, 0x40002}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-generic)\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004c80)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000940)="1beb41ea4ea9ca354f167d9eaee7dc35eca218b865688d79fe31cbe00d190c853bfe6a22bd7dec0023aa0e038d07000040e37e00f7dd3afafdbc70e1b5928033df5e82fd76f31e8b29a0f05c2cef56f56cd0330dc984004f220b7dcb23a05d530df65691cf6a3cceb7a97c673856f552ded9530b52fe6d1e662090d2802233ec1adca9eaab9dd6f04b2717ed1552cf46dc28cd3fbf1ec1eaedd80d1da838a00a1e229ce16d2c1a411be06f715e8b6aa7552800d5282e4e0bf3eaf55a", 0xbc}, {&(0x7f0000000b00)}], 0x2, 0x0, 0x0, 0x4004090}, {0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000540)="d21e61c0af08368aedabcf6e445f1ca30a2f37d1f6d14042afeb21e49b0da7fd9f", 0x21}, {&(0x7f0000000c00)}], 0x2, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000fc0)}], 0x1, 0x0, 0x0, 0x84090}], 0x3, 0x4004000) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f00000006c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x3, 0x0, 0x7, 0x0, 0x1, 0x0, 'syz0\x00', &(0x7f0000000680)=['']}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) executing program 0: socket$packet(0x11, 0x3, 0x300) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000096231306e53f070d0000002a940183", @ANYRES64=r0], 0x0}, 0x0) getresuid(&(0x7f0000000440), &(0x7f00000004c0), &(0x7f0000000500)) executing program 0: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001180)=ANY=[@ANYBLOB="12010000090003206d0414c34000ffff000109022400010400a000090400000103010100093700086ce82201000905815f"], 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x14, &(0x7f0000000dc0)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000780)={0x84, 0x0, 0x0, &(0x7f00000002c0)={0x0, 0x8, 0x1}, 0x0, &(0x7f0000000340)={0x20, 0x0, 0x4, {0x1000, 0x20}}, &(0x7f0000000380)={0x40, 0x7, 0x2, 0x4}, 0x0, &(0x7f0000000400)={0x40, 0xb, 0x2, "aa53"}, &(0x7f0000000440)={0x40, 0xf, 0x2, 0x3}, &(0x7f0000000480)={0x40, 0x13, 0x6}, &(0x7f00000004c0)={0x40, 0x17, 0x6, @random="8ec447dfa6ba"}, &(0x7f0000000500)={0x40, 0x19, 0x2, '&b'}, &(0x7f0000000540)={0x40, 0x1a, 0x2, 0x7}, &(0x7f0000000580)={0x40, 0x1c, 0x1, 0x3}, &(0x7f0000000600)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000640)={0x40, 0x21, 0x1, 0x8}}) syz_usb_control_io(r0, 0x0, 0x0) executing program 2: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0a00000007000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 1: bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x8000008}, 0x94) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) write$cgroup_devices(r0, &(0x7f0000000140)=ANY=[@ANYBLOB="1e031c00008c71ef288563"], 0xffdd) executing program 2: r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r0, 0x1, 0x29, &(0x7f00000000c0)=0xa, 0x4) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x25, &(0x7f0000000840)=0x473e, 0x4) sendmmsg$inet(r0, &(0x7f0000003240)=[{{&(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10, 0x0}}], 0x1, 0x4000800) recvmmsg(r0, &(0x7f00000031c0)=[{{0x0, 0x0, 0x0}, 0x75}], 0x1, 0x2100, 0x0) executing program 1: syz_emit_ethernet(0xbe, &(0x7f0000000000)={@dev={'\xaa\xaa\xaa\xaa\xaa', 0x23}, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @broadcast}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698d0a881c51852e4451b57d037ad3c045942824251d7d17b5191584bcd4fbe40a23424d", "bcfd56f1375461caaa2f19935e6996c7096ffeeb0300000000000064", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x3}, 0x94) recvfrom$l2tp6(0xffffffffffffffff, 0x0, 0x94, 0x40000002, 0x0, 0x0) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) executing program 2: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002500)=ANY=[], &(0x7f0000000340)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r0, 0x18000000000002a0, 0x204, 0x0, &(0x7f0000000040)="5aee41dea43e63a3f7fb7f11c72b", 0x0, 0xf000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) executing program 1: r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x4) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000004c0)={0x30, r3, 0x1, 0x70bd2c, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x1c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @dev={0xac, 0x14, 0x14, 0x1c}}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x3}]}]}, 0x30}}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000280)={0x20, r5, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0xc, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x1}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x48050}, 0x0) executing program 4: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000000c0)={0x84, @local, 0x15, 0x3, 'fo\x00', 0x1, 0x0, 0x69}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000380)={{0x84, @rand_addr=0x64010104, 0x4e24, 0x3, 'nq\x00', 0x8, 0x5, 0x55}, {@remote, 0x4e22, 0x0, 0x7, 0x12d5c, 0x12d58}}, 0x44) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-generic)\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004c80)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000940)="1beb41ea4ea9ca354f167d9eaee7dc35eca218b865688d79fe31cbe00d190c853bfe6a22bd7dec0023aa0e038d07000040e37e00f7dd3afafdbc70e1b5928033df5e82fd76f31e8b29a0f05c2cef56f56cd0330dc984004f220b7dcb23a0", 0x5e}, {&(0x7f0000000b00)}], 0x2, 0x0, 0x0, 0x4004090}, {0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000c00)}], 0x1, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000000640)=[{0x0}, {&(0x7f0000000fc0)}], 0x2, 0x0, 0x0, 0x84090}], 0x3, 0x4004000) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f00000006c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0x3}, 0x1c) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) write$tun(r0, &(0x7f0000000080)={@val={0x8, 0x800}, @val={0x0, 0x1, 0x6, 0x4, 0x2f, 0x40}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x28, 0x29, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x26}}, {0x4e26, 0x4e20, 0x15, 0x0, @gue={{0x2, 0x0, 0x3, 0x5, 0x0, @val=0x80}, "7982d60305"}}}}, 0x37) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {}, {0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x2, 0x20000000, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x38, r1, 0x5, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0x10, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000084}, 0x0) executing program 4: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0a00000007000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000140)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) executing program 2: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000000c0)={0x84, @local, 0x15, 0x3, 'fo\x00', 0x1, 0x0, 0x69}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000380)={{0x84, @rand_addr=0x64010104, 0x4e24, 0x3, 'nq\x00', 0x8, 0x5, 0x55}, {@remote, 0x4e22, 0x0, 0x7, 0x12d5c, 0x12d58}}, 0x44) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000dc0)=ANY=[@ANYRES32, @ANYBLOB="0800c3"], 0x33fe0}, 0x1, 0x0, 0x0, 0x40002}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004c80)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000b00)}], 0x1, 0x0, 0x0, 0x4004090}, {0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000540)="d21e61c0af08368aedabcf6e445f1ca30a2f37d1f6d14042afeb21e49b0da7fd9f", 0x21}, {&(0x7f0000000c00)}], 0x2, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000000640)=[{0x0}, {&(0x7f0000000fc0)}], 0x2, 0x0, 0x0, 0x84090}], 0x3, 0x4004000) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f00000006c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x3, 0x0, 0x7, 0x0, 0x1, 0x0, 'syz0\x00', &(0x7f0000000680)=['']}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b922, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xe, 0xb}, {0xf, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) close(r5) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x1e) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x304}, "3a9badf933cbd4a5", "f568be9086150c45fb95a5e557f520c287f0a2f14d34ef1e24b3046bba0aff40", "82703436", "5b29230ec59329e6"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) close(r0) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r9) sendmsg$NBD_CMD_CONNECT(r9, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r9) getsockopt$inet_udp_int(r8, 0x11, 0x6c, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(0x0, r5) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x4, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8990, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') socket$l2tp6(0xa, 0x2, 0x73) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r1 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x61d0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYRES32=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000824}, 0x8040) executing program 3: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002500)=ANY=[], &(0x7f0000000340)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r0, 0x18000000000002a0, 0x204, 0x0, &(0x7f0000000040)="5aee41dea43e63a3f7fb7f11c72b", 0x0, 0xf000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) executing program 2: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000040)={0x3b, &(0x7f0000000200)=[{0x20, '\x00', @buffer={"785f629b000bc36e4c47ceeef4e988279ccb9ce37f092b150598374457bf103b", 0x20}, 0x9}]}) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="40000000180015"], 0x40}], 0x1, 0x0, 0x0, 0x40065}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @dstopts_2292={{0x58, 0x29, 0x4, {0x4, 0x7, '\x00', [@generic={0xfe, 0x21, "f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4"}, @generic={0x80, 0x4, "09e12e5f"}, @ra={0x5, 0x2, 0xbf4}, @hao={0xc9, 0x10, @private2}]}}}, @hoplimit={{0x14}}, @hopopts={{0x30, 0x29, 0x36, {0x5e, 0x2, '\x00', [@generic={0xff}, @pad1, @pad1, @calipso={0x7, 0x8, {0x3, 0x0, 0x0, 0xfff}}]}}}], 0xb8}}], 0x1, 0x810) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001740)=[{{&(0x7f0000000480)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000100)=[{0x0}], 0x1}}], 0x1, 0x24088804) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000300)=[{{&(0x7f0000000280)={0xa, 0x4e20, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000600)="6a9ee35872dedd3fa3577ce3d64d437abb6e906ee0d0354bcc7edf38e105d37f635fbb3b9c00a3d3bc61866fb3389eff2a0443cf6c38450ce2732419a8329bbe26f4eb1c9edcbf53fb1b0df9c77d6864e90753e3800dff58b9950616473ea1e55b947db3de3ebb8f63edf11ebec9eef2da6b9f545e28273d239534a4682dc23c44a85f64d17bbf41e291f3e3092626f045d8b2b5df6e478729cc88a79aa5f7fe99e374f09c34fe5b63b6dffd256f4ab6ec553520f191b386b290ce1e7fe4c59288afbcafe11869395eaae3f556234701", 0xd0}, {&(0x7f0000002840)="33db2a1949865d5bb1c5bfb13ffb96a1cdad02489f447c9f6e61ae185cf1962c0bee82f04dfd646365d75c057a118bea734fb3f7e5bd047d4c32bf72ead3fa9aca6aeb1cc044533c24edc3e8ec198203ec244cb6b2b79bedc3a8a74e17e85b4c32c0819c4c77dcc823cb4fa659cffc6e8348b875e177f03f4378da4b36ac7df34de2f67398e62f3708bb83c1b0f505aaa85a3422cf0a710a03415896a50197b4a0624542e33fdad43547a88b0fc5d26804a2c8f54e65fbeaae715fbba862f15688e80655f3890ac49ca3ccb40cb2dd711b88d4480d20c760f12c23568c8b5fe181abc11d1f2ab914f875ba85f8355c9d248deef68e71555867160c0161a078f42d6778ee2bcc3015ccb433ff9022b312b620c18e4f4b3824d186e3051adf3a6e0332222108e63f6eda5a1517ee3765ae0677f165fde798d1917a2583aa4b52e67438cf61f0cadd336edf8b5f132d54f4ca42b3d8d39ccba6293913d4f233f29af17bcf049306e43f99ad7c321bacbfa17c2e8d8269e42c5390e279a1a1370c15bec875beb8542823f5ab28abb5d48fd5662bbf3516ef63120e56fffe7d1e86748b788f80ef4deaaaeb0815d8fa04bdd351a00618ff45c64a886de5a7b51408a1d53ce8d4d7c2891492e10d1de29d4e0ef564a859500f97048c1a0b319e1305c1f228882d02a227dea730ce09b1200813bfbf6750800d1bd8d2c264ac6063d4b0fb4cb42c1924a6fac095d848450a00dcc6a827b9d0bcc0131ff3da234568d469f1246848b71bd3dfbe767de19ffe542a0a37317d84bfc63c9449a4cc04446c859f972b77188eb5b7517540b70c5a0701c78ca108c09aadd28a91278cb6633d88cff45cfd5e30f87d6be9eb53cf89d5c047f3c36f490fa652a148c5d824b2d9cb8ffe1edb80cd48922aede8f3b22d21806572bf5b7bbcd27555b41e137eb06e5a3f514780796a2c8700d13eeb1800227298d82e42388a3aad5293562cc05650ef93d23d5290dc0de915d8143f76b2838cea8db2ca4cc802cd8d6d2c43c95f919bf0ebd7403f8047a0c010dcbc26a4bead1b274b573773ad2a2000c7730b49d5a97505024b905be151207a4d737233ccd853c4420391150e546b205181aa376088c5ccfe1b42da805cb6eca7e7d622daeff2c66d75697f7cc50ce2cc096cfedfd5d6cc5551a83dd3beb24ecf9c0160e190138e8eb9e86de71ccd5d76a258844e34683f7accd5f0b07a87be90b7ae6976f4a89183ab489754c9034eee063309f8d8f36914cc56887e80acb660b40f8960df4280641cc2199fd90d4f71923f041396b834d3af2558f04055e1133140d3a4399cf32a1a1d441056c114a5311f0a9a13ee68ddc1481ccad45bcec671d980f8cc1e2155a637bd2f9dcc8f7ab57683c841545f4c6a1e75ebf778b518e2185935f7c6b020ee30a29355f6bf0e5adaac184a25aba83aa5221d983235d8c277c81c26497c1d019056a56abf062203887bd4a1143b991ac51b2aa136793e331ef84556ec6d254e2adadf0d77c21d46fadbe3cd187bf36f18905e24f6dbeb7e2a75119f943d1cd55ec316a58116fb2f00d511ddddc7baa8dd8e67a7b2a6a5bcac586115dd8ff84a899503d06d62e1d51f82d2681811da3ac71c76133f81308e048734030f24e6988b1cc512c9518365f87c0f00776ef77cab78d0f04f4d077dec4705da22593d934ad32b7bd17c6dc9957d5b742ef8f0894b15c27c3fac6775bbf4cbe107b1d726d1ef6f6b1d20a7ea23b34b87cb3dfcd5747f4f598bb4832de298032db313bbc727f1ea41ac96c8979387b375490e3199585d2a932734ab265afc1fb12253ede0c5dfcf702c88619919c8b8aff987ceaddd9e40bb43d34599b50b07bf2fc605e5e2c8e8b70e63bc0893af943641c3ae65cf717aa01d537e44eab989fff563d22be3c6ba7e25bd4ef6c8001e87a59788ac3140143620cf8a6e62cdad64a11fca4bbdece3d3c8032850f40de027e2dbaa3b250af2babc1549b8f8fa72c52e868743ba43e183f50c8b9d8ce45d0acf64758fd65edb776199ee84c6da0d228e0627e0ea92949e4dc6ef5f023b7c6e1a9d261384fa4db33962341c330b710405b1a339209fdfc6cb2eb29a7fb3ccbe4a1c7e2daf4f6f1c227ed4b77384938d082f59bfee13585ca9fc46c232f62ebb6287c3e02018313f22c0c8096a37c1506873294ede68b3eba8cc66ca31f40f0d19ff1536fd8fb42b3ff2fa3b191194d6d04e2d056b0c3c0c4abd88bc1c7e4c5b1e7b31245acebf616d2746d461c8a75ae762b2df0862c7705f2cad59f00303afaa9d9e774d005eecb3fe80c5bee4266703c2981803d7aad43c42d312e9376fc2a03b3a9067e88e1a4c063646493a63cc95082ad51505176a7dda5b4493dbc78a4021f6a0d31868d75ee08bb6129e84f247eb3ad352ec045c8d5dc8ee5ad7b7eae948ae056f523a4745f3839cb763505afe12e8b0a988caba151b38549e06738a15dfec6a5597b31f47fbbcb622b4b6dce331b50a4a7561396da5e3cd3383840afc00ac0537bf03a8aab179330a38d15115a01b0db44c9302bc908a5d86c5acef4859fc7464a0e4f2970f4221bffdd617bff126e6256cfbd24be7dc1eee65996013cd23a184ba66c7c0cdeb6b551fab006fda43591645106cf836bed95c143df06918fc0a3c32f6eea50a5208550fb42503987e64571d718b751597998d76941feed27076b64492eea782db891df0f69e89a6211d584f9f9c7d090ec9f6dd70a590436dfa4790a534bdfc1f46fd1ddbbcee124cd9668d968d95add753b630262989cf986b146722242b17cb2bbb083b590ab4946cf25326024a6d4377a9988a3335a84e0eba9c4287cf5fd3304e11cba1119c22a6ae371aa82cd398499a80be864159c08b6925ecc3d25b2aa9a841a5131123e09697cc5e516e9a117b6e86a6ebee3bb39f0801ffcc65f1acbd69f8cab1a1ec921d144366af2049aac2d58cbc20333d1fd63695891d50209e50a281f3a1906d8d12b5dd1610c307901d6283db0e8833bb63714785332cc03f28111d64a6649267da73ef1d9ebb0bd584fd651cce2518ce7bf40c48b07d6f50b1aa224d656d1cd8db83f250ddac303ff8076a4c151abacb7ceb18b10cc3c3de6f929d3858074223765d0e0005606b550f4a00cc855a8d8a99dac57a4a8b15729638dd982aec22e79c42bf3b5f67fe2ab4632acadc954444fb54806d730880b48cb10d641f3b607e6413d106c0622ba4670c169c0bc3073cf6bf160e7989b78aaae81e7306727c2d13776d827a209a4a84805f2b8f5bbf2950e9d213a344f236c9dfbfe0a4fed7eb5d27d3bb15e89d454bc3dc83df918e57e8b4c763aeabdd00cd768b69a052e848694b97cef6c333eed2d3278cefa13c73c4d1b886c1c23c3a9a5533d4f0aea3416fb0054a42c3b61ec6eebd0cadff6106cc7b58e2b5aefd2d9482d37cdbc04cfff4e8efde9397598d3f164483613391be5d96eab911ab979c9418b26abcf05d14e1c1fc84a943829d3a84d08ea171034c60a953fca50fb373aa1ffe26cf1ed8f1e2b64b50f05f22af000ccdfc87fc5d999ee0d5ade3e1438747a55ac95482b6619c4bf41dea7d164aaa6922b2f563a95ac5f4b906c3bc8172a184e7d28a1e10e0a38455a4a326610b41da0e48fcd60be7417b9a92ad92ecc6068dbcb93543f02c1ca310d45d118869e06169f2164d4ce5a6f96a5b8b75bbcd945c8f7e947cb435051fcf6f8f8244269b4d3412aaf91374b18f385ba052eedd9613793a9d1382d30b912f0af55bd3b7a821fb1fc32c62434970afd2af33707487beb86fae9a927e1a10e20803ff58bf02213ff4b019df223589710d2fb436a930c009e513cec0a3733badfb7c183bb4fe18f3c1f3efabc18629462fb16a82aaae57e976f233d8debf50c6f2b7b1e53870103bcd4ce8ed53e5effffccd5fb0d45a235a326aa3d4381d9031b25913203b8eb2f170e30f4e324db5fd01e0ae5b86dd48a27aba37871fb7d3f4be672f1191bca2516d2c17a9aaba68ffa02fb999f7441e7238341fbea72a00b7f9f9acbca02a3157984f7a88ec809c1083dddec5151bedc6892d77cbb0f878ff2bbdb61922daaaf99a419bb9aaf41c2e49f9470dee0fbac03b84272626eb1e11b37b3b9d735df63f08965d3cd2bcdda5d34fe7919c976702a01d9a18bf6b1d2cc5ba4d78bb38634198003cf17a33e17391b3e0ff25368e8adf469861496dcd5868d163a2087c584df9874f4185752cc16ebdb852d60932ece37096301a718b7489f3688848996b649775533aa55918327ca1b5de7abb448c178d98e7e13cd4ce939326edefeb9ea6bb65fb6131cf0749425df1afb553411dad6041232ff4493aa644624b960badd643ebbd84e7c80bcf9acd1aa3bcb0bac9208b05098c6005b8", 0xc36}], 0x2, &(0x7f0000000b40)}}], 0x1, 0x4000081) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 4: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000000c0)={0x84, @local, 0x15, 0x3, 'fo\x00', 0x1, 0x0, 0x69}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000380)={{0x84, @rand_addr=0x64010104, 0x4e24, 0x3, 'nq\x00', 0x8, 0x5, 0x55}, {@remote, 0x4e22, 0x0, 0x7, 0x12d5c, 0x12d58}}, 0x44) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-generic)\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004c80)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000940)="1beb41ea4ea9ca354f167d9eaee7dc35eca218b865688d79fe31cbe00d190c853bfe6a22bd7dec0023aa0e038d07000040e37e00f7dd3afafdbc70e1b5928033df5e82fd76f31e8b29a0f05c2cef56f56cd0330dc984004f220b7dcb23a0", 0x5e}, {&(0x7f0000000b00)}], 0x2, 0x0, 0x0, 0x4004090}, {0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000c00)}], 0x1, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000000640)=[{0x0}, {&(0x7f0000000fc0)}], 0x2, 0x0, 0x0, 0x84090}], 0x3, 0x4004000) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f00000006c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="b700000000000000070000000000000095000000000000001e5286574356940658273ad1326fc65be4b1037a74cfb5af100fc4e94d123d9b22a7561b8850821bc1f8b5b0a3e3b79b0d96ab7cc60e0e144f0f04bfffe68fe46421a161eedd1a5cee316f68f7617859f06c8efd5da6abe446649c322209b1af93c6c999058168ad0a70992124d19c7c9cc22ff9a6b1a058039ab938480e8697f8715bcb18e1fd0773909464a783148e0e7b604a6c47b33c43a3ffff92ec8bbde1af40f29cfcf0836a70a2f6b1192ab8f24ca363492393e1c2a3b190180caafbf8cfca720074bdcc7cbd978efd8404a1c776001f78d97813926b19446ac8f823402eea2bdeaf5e99514e64e36cad5eba82010b2d149aa72e5f070000000000000000000000000000000000003a4a00009d5df0e0dbb9821d9c5402474d5866ce5eb60188d83ac741b45aeacac594cf09de9b460f48b96ae8a0eead478e46c8ca3e4c5d2b3cb4ad480100000000000000dcbf36b7e8be59ca4b46266cf75bea8a22ab71895d954dc6d28864144c73391770690a9301cde97565d5000000000000000455355d5d55f551df82ea475a711ec56d00000000507c093f4fad7095fbec5b005ebb710d87"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x48) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) executing program 3: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0a00000007000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xf}, 0x15, 0x3, 'lblcr\x00', 0x1, 0x6, 0x48}, 0x2c) socket$kcm(0xa, 0x2, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x10000, 0xc, 0x2}}, 0x44) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @loopback, 0x4e21, 0x3, 'lblcr\x00', 0x0, 0x81, 0x39}, {@rand_addr=0x64010500, 0x4e25, 0x3, 0xc3, 0xfffffff8, 0x12d5c}}, 0x44) r3 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r3, &(0x7f0000000400)={&(0x7f0000000140)=@in6={0x2, 0x15, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) write(r0, &(0x7f0000000600)="b7a27258eeb57eb735b6ed1bf5b29ebb2d5240787de075bdc2cf36967267e224fcbbcf968165848fb7e50964120f70981723b2c434c501ad1e450f9c8363f37485056c46930d3e3ada1f563942d9c3cfe84ed8816a3c6edba12715c196aec86f1ada73dae005f27fa073cca78c0a6e1433d1b68fae9cf3cc9248e284b9261101022ce604d6c37402dd50095d16d930915ed390bb1eb5eda8d625af17ba1b439097c46c82d24da04e26a767cf7b7dc9d2089ed3a128951f5b7a9c7bc05003d0c60c9a226a3aa64f52c7a083396874c996dd046b10e543c5434e08d5dcd17e2be8cfaec24c5ec2d2cf69dd226d1a74146043ec58f51d152165237cc018baeeedcd307373234e7f723358ebce3676917a4d0e723822a66f6ae40311b4fcf6bf8b452cf88661f82d1c306638f875c02b08fd594325a1ccd492dd7c3abd5e807b08993cf3a1a9d27b618fd66e0baf5ed7168b515b7c5cbc28ccaef476a1cb94d8b677c1c38373de577326a0f28db3c966e89f37ba64b0816539d7862aecb13b63bfadcc1615fe0c8c4ca8681754933d57568f642f0b10f8409fcc414fa29743346eab5d4efba1560be296c5ea584af830533cc83bbcb2a1536e069050db7ffe37e970504db09020cee2a1da136dcbf9b5ab27da2050b44cbb36690e3fade327783a3d0cceca374876d91a6b6001a8f06b7e4294f638b7eac5da085654fd7f5ecd3490d436288da5509cb8b9d3384d92e6cc5c1a611db2af9ab52f72c426a8e843fa160ddc7e1da0d2db4154389f8a07d2e9b2605549621b8cc71ea25b0983a7f07d9f370706559071ee1ab25cec05901f1da668de618f9ff3e6a76fd6f3d44dfb77ce2dc3b46a113adf0165e191967e3393e3ca023c0154541436f6d689001aab8be55b0751e51506f5f1bd908effc1acfcd7d07fda4ac30e396bee77b4d8f730ccdc95d0759e1e367a7aeb9888e471070456fa36cf66ddc5e783bddbabeff8c09f6d163b169db894d30e795df7688a6c4b1c4106dc5f2c149b74eabc9727f20ab7ad53c1252678c0be13ba179dc4bc580a99109c8ae8ec361eb0401a77bcc333fb150600790b048b1400b0be2378fd28a03c2fa7d75023c4ac16543593885163acd8f63ccc5859feec7dd0f5fe8f1cb1dad71a79ec636166162a4a2a14700932bbb86123a1a725ed5b31fcc5c824f8bb50c18b8ffd236bb1d712977375a7f47ded4e19dc02b00f11263e933d0c6965c748864066e65ada7c1fe31319dd87550979c0db5063342f70847b6eef4c4a2b23a8e42980a91ebaa8e4712b7aef0f7bc94538cb7229adc5259d10d9f92612af0ebb1d38112d32c7eae56ef08c631dbc277fc61a7daaaebd50ec87764b8e7456e160d7287aeb9702f16c5a38660e32cb4a1a18325605e9eb79bd038c3f50d47e489a1bdd5ed21d66188dff625cafe0f82a0367e70c3de0f3cfcce49a99646fec1670c351c3b31a5e7291a4508b3e21afe698f089e038f81f05658629c1008c3efc8a87f947f018138f68fabc7dd8260857efe6a6e4b035da3a80818a4cd305dc887550ae99da8b6dfff5b286f94527f12c4c24f7b31da274076a90e5cfc1078dc0da07b0378eb14ac4419803b9e6f4ad5fdd5662bf83862db6bd741cb3a4e55a3fbcd91524b27fc0f78f27d67872f33aa9c2dfeb2fd63990a8c396ce17807f2f996fae162c02c8a0accd0ce6ccce730d26dce8e0ec7c3f6da7ec4a4f8123e151500b49c8567ffe02d186e35d004ba920e1c6bbdf7960019ef7e229eac766cfdec721eb980ca0c8f825e4ab7a401747044a252fec53fdf054e0927997eb4120e7fd80fd9db7721ba6db538ac046885d308c8486ff67606baf32810b0147f3c88efb03daf7663f650cba7a5043c1e9f397f6aade481e6d69d9d2a222125941947e12f0008330cd9d6bf9eac09c02089638d89d7b5128a4df1781ffa570a971435091687bcccf034066201ebec67858126b3a98d1437c8fe7af3741118e024803a68836f7cf4f23e5ec44e0079f3123ad1715f71dfdb6cbd86c1c288cec9f9d6aae8a6b4d6fe85341eb67bb5a0a43bf75fd1ce7898a18dd11dac7eb604af235333b55ac1d4ec74756bb8d8b00632d0979ebca10e69a2c8bae6f874cf5d2a94a77ccc8c5ef3b88971aa982690ea4d9d7e1992400ec5dc1b966ee9535bda5a152c656c0675d411a86c4db394e8305fb08fe4866c39a7b48652f6c9262c9d54ebadf3e9063ac01eaff635d1b8cba72107abf13a8143531fd502bdecabd068f9396673c3112873d1b3bd48166d2057fc13a3abe827ad80cc110c16d37dd85590171f4aca89cef3e04420352a9264f31aecb212ae982f25b04c82345cba64880c705970ff5c191183494a3761831fe8f6728505a956fdcdc8084fd1f6dc56b54723600358d65a6b7d74238d762ceae8531c78e97fbae63018c8bc74855f8a02acb4b4c35d72397c019c927d61b60ef1931e7e39318ac0fdcd24e740c7902a7b3081263b8a8a3260b4cab4ca5feae236e449d84218fa8b11e11c128c36d1937262559067a08d316195f895a13bba21c89731560ed32a84849bd59f36cc7849e0529dd594f53b08bf1fa466800f375c0ca21f8dac0054b432662ec9e5b40447782d8e059863494ac42d2c64850c2753846a6db9bb26161feda3a0c8fb414df6af1c1e122383f7f18907eddb79cc0c19ecbe25ea280302f9b579f70f136d3b4289724775a1d2dc37a589b69d5dec01cea0969ba9c8db9d40aaf869d6e75193b4358d1fca6634b96f20da91eeff60a2e626d5c086fd8d308b6ce5cb75abad6083f58f775171fff767a3204cdf1e76713be1882deb686cea967134f01795f182ceff162348e6bca107b5effb73bb8", 0x7f5) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="b700000000000000070000000000000095000000000000001e5286574356940658273ad1326fc65be4b1037a74cfb5af100fc4e94d123d9b22a7561b8850821bc1f8b5b0a3e3b79b0d96ab7cc60e0e144f0f04bfffe68fe46421a161eedd1a5cee316f68f7617859f06c8efd5da6abe446649c322209b1af93c6c999058168ad0a70992124d19c7c9cc22ff9a6b1a058039ab938480e8697f8715bcb18e1fd0773909464a783148e0e7b604a6c47b33c43a3ffff92ec8bbde1af40f29cfcf0836a70a2f6b1192ab8f24ca363492393e1c2a3b190180caafbf8cfca720074bdcc7cbd978efd8404a1c776001f78d97813926b19446ac8f823402eea2bdeaf5e99514e64e36cad5eba82010b2d149aa72e5f070000000000000000000000000000000000003a4a00009d5df0e0dbb9821d9c5402474d5866ce5eb60188d83ac741b45aeacac594cf09de9b460f48b96ae8a0eead478e46c8ca3e4c5d2b3cb4ad480100000000000000dcbf36b7e8be59ca4b46266cf75bea8a22ab71895d954dc6d28864144c73391770690a9301cde97565d5000000000000000455355d5d55f551df82ea475a711ec56d00000000507c093f4fad7095fbec5b005ebb710d87"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x48) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x3) close(0x4) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x4) executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @broadcast, 0x11, 0x3, 'none\x00', 0x1, 0x6, 0x4e}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) socket(0xb, 0xa, 0x3f0b8395) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) program crashed: KASAN: use-after-free Read in ax25_release bisect: bisecting 30 programs bisect: split chunks (needed=false): <29> bisect: split chunk #0 of len 29 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 7, 4, 7, 6, 16, 15, 7, 28, 9, 3, 19, 17, 9, 7, 10, 3, 28, 17, 5] detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0x3}, 0x1c) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) write$tun(r0, &(0x7f0000000080)={@val={0x8, 0x800}, @val={0x0, 0x1, 0x6, 0x4, 0x2f, 0x40}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x28, 0x29, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x26}}, {0x4e26, 0x4e20, 0x15, 0x0, @gue={{0x2, 0x0, 0x3, 0x5, 0x0, @val=0x80}, "7982d60305"}}}}, 0x37) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {}, {0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x2, 0x20000000, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x38, r1, 0x5, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0x10, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000084}, 0x0) executing program 4: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0a00000007000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000140)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) executing program 2: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000000c0)={0x84, @local, 0x15, 0x3, 'fo\x00', 0x1, 0x0, 0x69}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000380)={{0x84, @rand_addr=0x64010104, 0x4e24, 0x3, 'nq\x00', 0x8, 0x5, 0x55}, {@remote, 0x4e22, 0x0, 0x7, 0x12d5c, 0x12d58}}, 0x44) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000dc0)=ANY=[@ANYRES32, @ANYBLOB="0800c3"], 0x33fe0}, 0x1, 0x0, 0x0, 0x40002}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004c80)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000b00)}], 0x1, 0x0, 0x0, 0x4004090}, {0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000540)="d21e61c0af08368aedabcf6e445f1ca30a2f37d1f6d14042afeb21e49b0da7fd9f", 0x21}, {&(0x7f0000000c00)}], 0x2, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000000640)=[{0x0}, {&(0x7f0000000fc0)}], 0x2, 0x0, 0x0, 0x84090}], 0x3, 0x4004000) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f00000006c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x3, 0x0, 0x7, 0x0, 0x1, 0x0, 'syz0\x00', &(0x7f0000000680)=['']}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b922, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xe, 0xb}, {0xf, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) close(r5) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x1e) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x304}, "3a9badf933cbd4a5", "f568be9086150c45fb95a5e557f520c287f0a2f14d34ef1e24b3046bba0aff40", "82703436", "5b29230ec59329e6"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) close(r0) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r9) sendmsg$NBD_CMD_CONNECT(r9, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r9) getsockopt$inet_udp_int(r8, 0x11, 0x6c, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(0x0, r5) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x4, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8990, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') socket$l2tp6(0xa, 0x2, 0x73) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r1 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x61d0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYRES32=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000824}, 0x8040) executing program 3: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002500)=ANY=[], &(0x7f0000000340)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r0, 0x18000000000002a0, 0x204, 0x0, &(0x7f0000000040)="5aee41dea43e63a3f7fb7f11c72b", 0x0, 0xf000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) executing program 2: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000040)={0x3b, &(0x7f0000000200)=[{0x20, '\x00', @buffer={"785f629b000bc36e4c47ceeef4e988279ccb9ce37f092b150598374457bf103b", 0x20}, 0x9}]}) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="40000000180015"], 0x40}], 0x1, 0x0, 0x0, 0x40065}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @dstopts_2292={{0x58, 0x29, 0x4, {0x4, 0x7, '\x00', [@generic={0xfe, 0x21, "f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4"}, @generic={0x80, 0x4, "09e12e5f"}, @ra={0x5, 0x2, 0xbf4}, @hao={0xc9, 0x10, @private2}]}}}, @hoplimit={{0x14}}, @hopopts={{0x30, 0x29, 0x36, {0x5e, 0x2, '\x00', [@generic={0xff}, @pad1, @pad1, @calipso={0x7, 0x8, {0x3, 0x0, 0x0, 0xfff}}]}}}], 0xb8}}], 0x1, 0x810) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001740)=[{{&(0x7f0000000480)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000100)=[{0x0}], 0x1}}], 0x1, 0x24088804) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000300)=[{{&(0x7f0000000280)={0xa, 0x4e20, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000600)="6a9ee35872dedd3fa3577ce3d64d437abb6e906ee0d0354bcc7edf38e105d37f635fbb3b9c00a3d3bc61866fb3389eff2a0443cf6c38450ce2732419a8329bbe26f4eb1c9edcbf53fb1b0df9c77d6864e90753e3800dff58b9950616473ea1e55b947db3de3ebb8f63edf11ebec9eef2da6b9f545e28273d239534a4682dc23c44a85f64d17bbf41e291f3e3092626f045d8b2b5df6e478729cc88a79aa5f7fe99e374f09c34fe5b63b6dffd256f4ab6ec553520f191b386b290ce1e7fe4c59288afbcafe11869395eaae3f556234701", 0xd0}, {&(0x7f0000002840)="33db2a1949865d5bb1c5bfb13ffb96a1cdad02489f447c9f6e61ae185cf1962c0bee82f04dfd646365d75c057a118bea734fb3f7e5bd047d4c32bf72ead3fa9aca6aeb1cc044533c24edc3e8ec198203ec244cb6b2b79bedc3a8a74e17e85b4c32c0819c4c77dcc823cb4fa659cffc6e8348b875e177f03f4378da4b36ac7df34de2f67398e62f3708bb83c1b0f505aaa85a3422cf0a710a03415896a50197b4a0624542e33fdad43547a88b0fc5d26804a2c8f54e65fbeaae715fbba862f15688e80655f3890ac49ca3ccb40cb2dd711b88d4480d20c760f12c23568c8b5fe181abc11d1f2ab914f875ba85f8355c9d248deef68e71555867160c0161a078f42d6778ee2bcc3015ccb433ff9022b312b620c18e4f4b3824d186e3051adf3a6e0332222108e63f6eda5a1517ee3765ae0677f165fde798d1917a2583aa4b52e67438cf61f0cadd336edf8b5f132d54f4ca42b3d8d39ccba6293913d4f233f29af17bcf049306e43f99ad7c321bacbfa17c2e8d8269e42c5390e279a1a1370c15bec875beb8542823f5ab28abb5d48fd5662bbf3516ef63120e56fffe7d1e86748b788f80ef4deaaaeb0815d8fa04bdd351a00618ff45c64a886de5a7b51408a1d53ce8d4d7c2891492e10d1de29d4e0ef564a859500f97048c1a0b319e1305c1f228882d02a227dea730ce09b1200813bfbf6750800d1bd8d2c264ac6063d4b0fb4cb42c1924a6fac095d848450a00dcc6a827b9d0bcc0131ff3da234568d469f1246848b71bd3dfbe767de19ffe542a0a37317d84bfc63c9449a4cc04446c859f972b77188eb5b7517540b70c5a0701c78ca108c09aadd28a91278cb6633d88cff45cfd5e30f87d6be9eb53cf89d5c047f3c36f490fa652a148c5d824b2d9cb8ffe1edb80cd48922aede8f3b22d21806572bf5b7bbcd27555b41e137eb06e5a3f514780796a2c8700d13eeb1800227298d82e42388a3aad5293562cc05650ef93d23d5290dc0de915d8143f76b2838cea8db2ca4cc802cd8d6d2c43c95f919bf0ebd7403f8047a0c010dcbc26a4bead1b274b573773ad2a2000c7730b49d5a97505024b905be151207a4d737233ccd853c4420391150e546b205181aa376088c5ccfe1b42da805cb6eca7e7d622daeff2c66d75697f7cc50ce2cc096cfedfd5d6cc5551a83dd3beb24ecf9c0160e190138e8eb9e86de71ccd5d76a258844e34683f7accd5f0b07a87be90b7ae6976f4a89183ab489754c9034eee063309f8d8f36914cc56887e80acb660b40f8960df4280641cc2199fd90d4f71923f041396b834d3af2558f04055e1133140d3a4399cf32a1a1d441056c114a5311f0a9a13ee68ddc1481ccad45bcec671d980f8cc1e2155a637bd2f9dcc8f7ab57683c841545f4c6a1e75ebf778b518e2185935f7c6b020ee30a29355f6bf0e5adaac184a25aba83aa5221d983235d8c277c81c26497c1d019056a56abf062203887bd4a1143b991ac51b2aa136793e331ef84556ec6d254e2adadf0d77c21d46fadbe3cd187bf36f18905e24f6dbeb7e2a75119f943d1cd55ec316a58116fb2f00d511ddddc7baa8dd8e67a7b2a6a5bcac586115dd8ff84a899503d06d62e1d51f82d2681811da3ac71c76133f81308e048734030f24e6988b1cc512c9518365f87c0f00776ef77cab78d0f04f4d077dec4705da22593d934ad32b7bd17c6dc9957d5b742ef8f0894b15c27c3fac6775bbf4cbe107b1d726d1ef6f6b1d20a7ea23b34b87cb3dfcd5747f4f598bb4832de298032db313bbc727f1ea41ac96c8979387b375490e3199585d2a932734ab265afc1fb12253ede0c5dfcf702c88619919c8b8aff987ceaddd9e40bb43d34599b50b07bf2fc605e5e2c8e8b70e63bc0893af943641c3ae65cf717aa01d537e44eab989fff563d22be3c6ba7e25bd4ef6c8001e87a59788ac3140143620cf8a6e62cdad64a11fca4bbdece3d3c8032850f40de027e2dbaa3b250af2babc1549b8f8fa72c52e868743ba43e183f50c8b9d8ce45d0acf64758fd65edb776199ee84c6da0d228e0627e0ea92949e4dc6ef5f023b7c6e1a9d261384fa4db33962341c330b710405b1a339209fdfc6cb2eb29a7fb3ccbe4a1c7e2daf4f6f1c227ed4b77384938d082f59bfee13585ca9fc46c232f62ebb6287c3e02018313f22c0c8096a37c1506873294ede68b3eba8cc66ca31f40f0d19ff1536fd8fb42b3ff2fa3b191194d6d04e2d056b0c3c0c4abd88bc1c7e4c5b1e7b31245acebf616d2746d461c8a75ae762b2df0862c7705f2cad59f00303afaa9d9e774d005eecb3fe80c5bee4266703c2981803d7aad43c42d312e9376fc2a03b3a9067e88e1a4c063646493a63cc95082ad51505176a7dda5b4493dbc78a4021f6a0d31868d75ee08bb6129e84f247eb3ad352ec045c8d5dc8ee5ad7b7eae948ae056f523a4745f3839cb763505afe12e8b0a988caba151b38549e06738a15dfec6a5597b31f47fbbcb622b4b6dce331b50a4a7561396da5e3cd3383840afc00ac0537bf03a8aab179330a38d15115a01b0db44c9302bc908a5d86c5acef4859fc7464a0e4f2970f4221bffdd617bff126e6256cfbd24be7dc1eee65996013cd23a184ba66c7c0cdeb6b551fab006fda43591645106cf836bed95c143df06918fc0a3c32f6eea50a5208550fb42503987e64571d718b751597998d76941feed27076b64492eea782db891df0f69e89a6211d584f9f9c7d090ec9f6dd70a590436dfa4790a534bdfc1f46fd1ddbbcee124cd9668d968d95add753b630262989cf986b146722242b17cb2bbb083b590ab4946cf25326024a6d4377a9988a3335a84e0eba9c4287cf5fd3304e11cba1119c22a6ae371aa82cd398499a80be864159c08b6925ecc3d25b2aa9a841a5131123e09697cc5e516e9a117b6e86a6ebee3bb39f0801ffcc65f1acbd69f8cab1a1ec921d144366af2049aac2d58cbc20333d1fd63695891d50209e50a281f3a1906d8d12b5dd1610c307901d6283db0e8833bb63714785332cc03f28111d64a6649267da73ef1d9ebb0bd584fd651cce2518ce7bf40c48b07d6f50b1aa224d656d1cd8db83f250ddac303ff8076a4c151abacb7ceb18b10cc3c3de6f929d3858074223765d0e0005606b550f4a00cc855a8d8a99dac57a4a8b15729638dd982aec22e79c42bf3b5f67fe2ab4632acadc954444fb54806d730880b48cb10d641f3b607e6413d106c0622ba4670c169c0bc3073cf6bf160e7989b78aaae81e7306727c2d13776d827a209a4a84805f2b8f5bbf2950e9d213a344f236c9dfbfe0a4fed7eb5d27d3bb15e89d454bc3dc83df918e57e8b4c763aeabdd00cd768b69a052e848694b97cef6c333eed2d3278cefa13c73c4d1b886c1c23c3a9a5533d4f0aea3416fb0054a42c3b61ec6eebd0cadff6106cc7b58e2b5aefd2d9482d37cdbc04cfff4e8efde9397598d3f164483613391be5d96eab911ab979c9418b26abcf05d14e1c1fc84a943829d3a84d08ea171034c60a953fca50fb373aa1ffe26cf1ed8f1e2b64b50f05f22af000ccdfc87fc5d999ee0d5ade3e1438747a55ac95482b6619c4bf41dea7d164aaa6922b2f563a95ac5f4b906c3bc8172a184e7d28a1e10e0a38455a4a326610b41da0e48fcd60be7417b9a92ad92ecc6068dbcb93543f02c1ca310d45d118869e06169f2164d4ce5a6f96a5b8b75bbcd945c8f7e947cb435051fcf6f8f8244269b4d3412aaf91374b18f385ba052eedd9613793a9d1382d30b912f0af55bd3b7a821fb1fc32c62434970afd2af33707487beb86fae9a927e1a10e20803ff58bf02213ff4b019df223589710d2fb436a930c009e513cec0a3733badfb7c183bb4fe18f3c1f3efabc18629462fb16a82aaae57e976f233d8debf50c6f2b7b1e53870103bcd4ce8ed53e5effffccd5fb0d45a235a326aa3d4381d9031b25913203b8eb2f170e30f4e324db5fd01e0ae5b86dd48a27aba37871fb7d3f4be672f1191bca2516d2c17a9aaba68ffa02fb999f7441e7238341fbea72a00b7f9f9acbca02a3157984f7a88ec809c1083dddec5151bedc6892d77cbb0f878ff2bbdb61922daaaf99a419bb9aaf41c2e49f9470dee0fbac03b84272626eb1e11b37b3b9d735df63f08965d3cd2bcdda5d34fe7919c976702a01d9a18bf6b1d2cc5ba4d78bb38634198003cf17a33e17391b3e0ff25368e8adf469861496dcd5868d163a2087c584df9874f4185752cc16ebdb852d60932ece37096301a718b7489f3688848996b649775533aa55918327ca1b5de7abb448c178d98e7e13cd4ce939326edefeb9ea6bb65fb6131cf0749425df1afb553411dad6041232ff4493aa644624b960badd643ebbd84e7c80bcf9acd1aa3bcb0bac9208b05098c6005b8", 0xc36}], 0x2, &(0x7f0000000b40)}}], 0x1, 0x4000081) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 4: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000000c0)={0x84, @local, 0x15, 0x3, 'fo\x00', 0x1, 0x0, 0x69}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000380)={{0x84, @rand_addr=0x64010104, 0x4e24, 0x3, 'nq\x00', 0x8, 0x5, 0x55}, {@remote, 0x4e22, 0x0, 0x7, 0x12d5c, 0x12d58}}, 0x44) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-generic)\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004c80)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000940)="1beb41ea4ea9ca354f167d9eaee7dc35eca218b865688d79fe31cbe00d190c853bfe6a22bd7dec0023aa0e038d07000040e37e00f7dd3afafdbc70e1b5928033df5e82fd76f31e8b29a0f05c2cef56f56cd0330dc984004f220b7dcb23a0", 0x5e}, {&(0x7f0000000b00)}], 0x2, 0x0, 0x0, 0x4004090}, {0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000c00)}], 0x1, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000000640)=[{0x0}, {&(0x7f0000000fc0)}], 0x2, 0x0, 0x0, 0x84090}], 0x3, 0x4004000) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f00000006c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="b700000000000000070000000000000095000000000000001e5286574356940658273ad1326fc65be4b1037a74cfb5af100fc4e94d123d9b22a7561b8850821bc1f8b5b0a3e3b79b0d96ab7cc60e0e144f0f04bfffe68fe46421a161eedd1a5cee316f68f7617859f06c8efd5da6abe446649c322209b1af93c6c999058168ad0a70992124d19c7c9cc22ff9a6b1a058039ab938480e8697f8715bcb18e1fd0773909464a783148e0e7b604a6c47b33c43a3ffff92ec8bbde1af40f29cfcf0836a70a2f6b1192ab8f24ca363492393e1c2a3b190180caafbf8cfca720074bdcc7cbd978efd8404a1c776001f78d97813926b19446ac8f823402eea2bdeaf5e99514e64e36cad5eba82010b2d149aa72e5f070000000000000000000000000000000000003a4a00009d5df0e0dbb9821d9c5402474d5866ce5eb60188d83ac741b45aeacac594cf09de9b460f48b96ae8a0eead478e46c8ca3e4c5d2b3cb4ad480100000000000000dcbf36b7e8be59ca4b46266cf75bea8a22ab71895d954dc6d28864144c73391770690a9301cde97565d5000000000000000455355d5d55f551df82ea475a711ec56d00000000507c093f4fad7095fbec5b005ebb710d87"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x48) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) executing program 3: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0a00000007000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xf}, 0x15, 0x3, 'lblcr\x00', 0x1, 0x6, 0x48}, 0x2c) socket$kcm(0xa, 0x2, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x10000, 0xc, 0x2}}, 0x44) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @loopback, 0x4e21, 0x3, 'lblcr\x00', 0x0, 0x81, 0x39}, {@rand_addr=0x64010500, 0x4e25, 0x3, 0xc3, 0xfffffff8, 0x12d5c}}, 0x44) r3 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r3, &(0x7f0000000400)={&(0x7f0000000140)=@in6={0x2, 0x15, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) write(r0, &(0x7f0000000600)="b7a27258eeb57eb735b6ed1bf5b29ebb2d5240787de075bdc2cf36967267e224fcbbcf968165848fb7e50964120f70981723b2c434c501ad1e450f9c8363f37485056c46930d3e3ada1f563942d9c3cfe84ed8816a3c6edba12715c196aec86f1ada73dae005f27fa073cca78c0a6e1433d1b68fae9cf3cc9248e284b9261101022ce604d6c37402dd50095d16d930915ed390bb1eb5eda8d625af17ba1b439097c46c82d24da04e26a767cf7b7dc9d2089ed3a128951f5b7a9c7bc05003d0c60c9a226a3aa64f52c7a083396874c996dd046b10e543c5434e08d5dcd17e2be8cfaec24c5ec2d2cf69dd226d1a74146043ec58f51d152165237cc018baeeedcd307373234e7f723358ebce3676917a4d0e723822a66f6ae40311b4fcf6bf8b452cf88661f82d1c306638f875c02b08fd594325a1ccd492dd7c3abd5e807b08993cf3a1a9d27b618fd66e0baf5ed7168b515b7c5cbc28ccaef476a1cb94d8b677c1c38373de577326a0f28db3c966e89f37ba64b0816539d7862aecb13b63bfadcc1615fe0c8c4ca8681754933d57568f642f0b10f8409fcc414fa29743346eab5d4efba1560be296c5ea584af830533cc83bbcb2a1536e069050db7ffe37e970504db09020cee2a1da136dcbf9b5ab27da2050b44cbb36690e3fade327783a3d0cceca374876d91a6b6001a8f06b7e4294f638b7eac5da085654fd7f5ecd3490d436288da5509cb8b9d3384d92e6cc5c1a611db2af9ab52f72c426a8e843fa160ddc7e1da0d2db4154389f8a07d2e9b2605549621b8cc71ea25b0983a7f07d9f370706559071ee1ab25cec05901f1da668de618f9ff3e6a76fd6f3d44dfb77ce2dc3b46a113adf0165e191967e3393e3ca023c0154541436f6d689001aab8be55b0751e51506f5f1bd908effc1acfcd7d07fda4ac30e396bee77b4d8f730ccdc95d0759e1e367a7aeb9888e471070456fa36cf66ddc5e783bddbabeff8c09f6d163b169db894d30e795df7688a6c4b1c4106dc5f2c149b74eabc9727f20ab7ad53c1252678c0be13ba179dc4bc580a99109c8ae8ec361eb0401a77bcc333fb150600790b048b1400b0be2378fd28a03c2fa7d75023c4ac16543593885163acd8f63ccc5859feec7dd0f5fe8f1cb1dad71a79ec636166162a4a2a14700932bbb86123a1a725ed5b31fcc5c824f8bb50c18b8ffd236bb1d712977375a7f47ded4e19dc02b00f11263e933d0c6965c748864066e65ada7c1fe31319dd87550979c0db5063342f70847b6eef4c4a2b23a8e42980a91ebaa8e4712b7aef0f7bc94538cb7229adc5259d10d9f92612af0ebb1d38112d32c7eae56ef08c631dbc277fc61a7daaaebd50ec87764b8e7456e160d7287aeb9702f16c5a38660e32cb4a1a18325605e9eb79bd038c3f50d47e489a1bdd5ed21d66188dff625cafe0f82a0367e70c3de0f3cfcce49a99646fec1670c351c3b31a5e7291a4508b3e21afe698f089e038f81f05658629c1008c3efc8a87f947f018138f68fabc7dd8260857efe6a6e4b035da3a80818a4cd305dc887550ae99da8b6dfff5b286f94527f12c4c24f7b31da274076a90e5cfc1078dc0da07b0378eb14ac4419803b9e6f4ad5fdd5662bf83862db6bd741cb3a4e55a3fbcd91524b27fc0f78f27d67872f33aa9c2dfeb2fd63990a8c396ce17807f2f996fae162c02c8a0accd0ce6ccce730d26dce8e0ec7c3f6da7ec4a4f8123e151500b49c8567ffe02d186e35d004ba920e1c6bbdf7960019ef7e229eac766cfdec721eb980ca0c8f825e4ab7a401747044a252fec53fdf054e0927997eb4120e7fd80fd9db7721ba6db538ac046885d308c8486ff67606baf32810b0147f3c88efb03daf7663f650cba7a5043c1e9f397f6aade481e6d69d9d2a222125941947e12f0008330cd9d6bf9eac09c02089638d89d7b5128a4df1781ffa570a971435091687bcccf034066201ebec67858126b3a98d1437c8fe7af3741118e024803a68836f7cf4f23e5ec44e0079f3123ad1715f71dfdb6cbd86c1c288cec9f9d6aae8a6b4d6fe85341eb67bb5a0a43bf75fd1ce7898a18dd11dac7eb604af235333b55ac1d4ec74756bb8d8b00632d0979ebca10e69a2c8bae6f874cf5d2a94a77ccc8c5ef3b88971aa982690ea4d9d7e1992400ec5dc1b966ee9535bda5a152c656c0675d411a86c4db394e8305fb08fe4866c39a7b48652f6c9262c9d54ebadf3e9063ac01eaff635d1b8cba72107abf13a8143531fd502bdecabd068f9396673c3112873d1b3bd48166d2057fc13a3abe827ad80cc110c16d37dd85590171f4aca89cef3e04420352a9264f31aecb212ae982f25b04c82345cba64880c705970ff5c191183494a3761831fe8f6728505a956fdcdc8084fd1f6dc56b54723600358d65a6b7d74238d762ceae8531c78e97fbae63018c8bc74855f8a02acb4b4c35d72397c019c927d61b60ef1931e7e39318ac0fdcd24e740c7902a7b3081263b8a8a3260b4cab4ca5feae236e449d84218fa8b11e11c128c36d1937262559067a08d316195f895a13bba21c89731560ed32a84849bd59f36cc7849e0529dd594f53b08bf1fa466800f375c0ca21f8dac0054b432662ec9e5b40447782d8e059863494ac42d2c64850c2753846a6db9bb26161feda3a0c8fb414df6af1c1e122383f7f18907eddb79cc0c19ecbe25ea280302f9b579f70f136d3b4289724775a1d2dc37a589b69d5dec01cea0969ba9c8db9d40aaf869d6e75193b4358d1fca6634b96f20da91eeff60a2e626d5c086fd8d308b6ce5cb75abad6083f58f775171fff767a3204cdf1e76713be1882deb686cea967134f01795f182ceff162348e6bca107b5effb73bb8", 0x7f5) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="b700000000000000070000000000000095000000000000001e5286574356940658273ad1326fc65be4b1037a74cfb5af100fc4e94d123d9b22a7561b8850821bc1f8b5b0a3e3b79b0d96ab7cc60e0e144f0f04bfffe68fe46421a161eedd1a5cee316f68f7617859f06c8efd5da6abe446649c322209b1af93c6c999058168ad0a70992124d19c7c9cc22ff9a6b1a058039ab938480e8697f8715bcb18e1fd0773909464a783148e0e7b604a6c47b33c43a3ffff92ec8bbde1af40f29cfcf0836a70a2f6b1192ab8f24ca363492393e1c2a3b190180caafbf8cfca720074bdcc7cbd978efd8404a1c776001f78d97813926b19446ac8f823402eea2bdeaf5e99514e64e36cad5eba82010b2d149aa72e5f070000000000000000000000000000000000003a4a00009d5df0e0dbb9821d9c5402474d5866ce5eb60188d83ac741b45aeacac594cf09de9b460f48b96ae8a0eead478e46c8ca3e4c5d2b3cb4ad480100000000000000dcbf36b7e8be59ca4b46266cf75bea8a22ab71895d954dc6d28864144c73391770690a9301cde97565d5000000000000000455355d5d55f551df82ea475a711ec56d00000000507c093f4fad7095fbec5b005ebb710d87"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x48) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x3) close(0x4) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x4) executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @broadcast, 0x11, 0x3, 'none\x00', 0x1, 0x6, 0x4e}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) socket(0xb, 0xa, 0x3f0b8395) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 19, 17, 9, 7, 10, 3, 28, 17, 5] detailed listing: executing program 3: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, &(0x7f0000002500)=ANY=[], &(0x7f0000000340)='GPL\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={r0, 0x18000000000002a0, 0x204, 0x0, &(0x7f0000000040)="5aee41dea43e63a3f7fb7f11c72b", 0x0, 0xf000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) executing program 2: r0 = syz_open_dev$dvb_frontend(&(0x7f0000000080), 0x0, 0x2) ioctl$FE_SET_PROPERTY(r0, 0x40106f52, &(0x7f0000000040)={0x3b, &(0x7f0000000200)=[{0x20, '\x00', @buffer={"785f629b000bc36e4c47ceeef4e988279ccb9ce37f092b150598374457bf103b", 0x20}, 0x9}]}) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="40000000180015"], 0x40}], 0x1, 0x0, 0x0, 0x40065}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000ec0)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}, @dstopts_2292={{0x58, 0x29, 0x4, {0x4, 0x7, '\x00', [@generic={0xfe, 0x21, "f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4"}, @generic={0x80, 0x4, "09e12e5f"}, @ra={0x5, 0x2, 0xbf4}, @hao={0xc9, 0x10, @private2}]}}}, @hoplimit={{0x14}}, @hopopts={{0x30, 0x29, 0x36, {0x5e, 0x2, '\x00', [@generic={0xff}, @pad1, @pad1, @calipso={0x7, 0x8, {0x3, 0x0, 0x0, 0xfff}}]}}}], 0xb8}}], 0x1, 0x810) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000001740)=[{{&(0x7f0000000480)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c, &(0x7f0000000100)=[{0x0}], 0x1}}], 0x1, 0x24088804) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000300)=[{{&(0x7f0000000280)={0xa, 0x4e20, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c, &(0x7f00000002c0)=[{&(0x7f0000000600)="6a9ee35872dedd3fa3577ce3d64d437abb6e906ee0d0354bcc7edf38e105d37f635fbb3b9c00a3d3bc61866fb3389eff2a0443cf6c38450ce2732419a8329bbe26f4eb1c9edcbf53fb1b0df9c77d6864e90753e3800dff58b9950616473ea1e55b947db3de3ebb8f63edf11ebec9eef2da6b9f545e28273d239534a4682dc23c44a85f64d17bbf41e291f3e3092626f045d8b2b5df6e478729cc88a79aa5f7fe99e374f09c34fe5b63b6dffd256f4ab6ec553520f191b386b290ce1e7fe4c59288afbcafe11869395eaae3f556234701", 0xd0}, {&(0x7f0000002840)="33db2a1949865d5bb1c5bfb13ffb96a1cdad02489f447c9f6e61ae185cf1962c0bee82f04dfd646365d75c057a118bea734fb3f7e5bd047d4c32bf72ead3fa9aca6aeb1cc044533c24edc3e8ec198203ec244cb6b2b79bedc3a8a74e17e85b4c32c0819c4c77dcc823cb4fa659cffc6e8348b875e177f03f4378da4b36ac7df34de2f67398e62f3708bb83c1b0f505aaa85a3422cf0a710a03415896a50197b4a0624542e33fdad43547a88b0fc5d26804a2c8f54e65fbeaae715fbba862f15688e80655f3890ac49ca3ccb40cb2dd711b88d4480d20c760f12c23568c8b5fe181abc11d1f2ab914f875ba85f8355c9d248deef68e71555867160c0161a078f42d6778ee2bcc3015ccb433ff9022b312b620c18e4f4b3824d186e3051adf3a6e0332222108e63f6eda5a1517ee3765ae0677f165fde798d1917a2583aa4b52e67438cf61f0cadd336edf8b5f132d54f4ca42b3d8d39ccba6293913d4f233f29af17bcf049306e43f99ad7c321bacbfa17c2e8d8269e42c5390e279a1a1370c15bec875beb8542823f5ab28abb5d48fd5662bbf3516ef63120e56fffe7d1e86748b788f80ef4deaaaeb0815d8fa04bdd351a00618ff45c64a886de5a7b51408a1d53ce8d4d7c2891492e10d1de29d4e0ef564a859500f97048c1a0b319e1305c1f228882d02a227dea730ce09b1200813bfbf6750800d1bd8d2c264ac6063d4b0fb4cb42c1924a6fac095d848450a00dcc6a827b9d0bcc0131ff3da234568d469f1246848b71bd3dfbe767de19ffe542a0a37317d84bfc63c9449a4cc04446c859f972b77188eb5b7517540b70c5a0701c78ca108c09aadd28a91278cb6633d88cff45cfd5e30f87d6be9eb53cf89d5c047f3c36f490fa652a148c5d824b2d9cb8ffe1edb80cd48922aede8f3b22d21806572bf5b7bbcd27555b41e137eb06e5a3f514780796a2c8700d13eeb1800227298d82e42388a3aad5293562cc05650ef93d23d5290dc0de915d8143f76b2838cea8db2ca4cc802cd8d6d2c43c95f919bf0ebd7403f8047a0c010dcbc26a4bead1b274b573773ad2a2000c7730b49d5a97505024b905be151207a4d737233ccd853c4420391150e546b205181aa376088c5ccfe1b42da805cb6eca7e7d622daeff2c66d75697f7cc50ce2cc096cfedfd5d6cc5551a83dd3beb24ecf9c0160e190138e8eb9e86de71ccd5d76a258844e34683f7accd5f0b07a87be90b7ae6976f4a89183ab489754c9034eee063309f8d8f36914cc56887e80acb660b40f8960df4280641cc2199fd90d4f71923f041396b834d3af2558f04055e1133140d3a4399cf32a1a1d441056c114a5311f0a9a13ee68ddc1481ccad45bcec671d980f8cc1e2155a637bd2f9dcc8f7ab57683c841545f4c6a1e75ebf778b518e2185935f7c6b020ee30a29355f6bf0e5adaac184a25aba83aa5221d983235d8c277c81c26497c1d019056a56abf062203887bd4a1143b991ac51b2aa136793e331ef84556ec6d254e2adadf0d77c21d46fadbe3cd187bf36f18905e24f6dbeb7e2a75119f943d1cd55ec316a58116fb2f00d511ddddc7baa8dd8e67a7b2a6a5bcac586115dd8ff84a899503d06d62e1d51f82d2681811da3ac71c76133f81308e048734030f24e6988b1cc512c9518365f87c0f00776ef77cab78d0f04f4d077dec4705da22593d934ad32b7bd17c6dc9957d5b742ef8f0894b15c27c3fac6775bbf4cbe107b1d726d1ef6f6b1d20a7ea23b34b87cb3dfcd5747f4f598bb4832de298032db313bbc727f1ea41ac96c8979387b375490e3199585d2a932734ab265afc1fb12253ede0c5dfcf702c88619919c8b8aff987ceaddd9e40bb43d34599b50b07bf2fc605e5e2c8e8b70e63bc0893af943641c3ae65cf717aa01d537e44eab989fff563d22be3c6ba7e25bd4ef6c8001e87a59788ac3140143620cf8a6e62cdad64a11fca4bbdece3d3c8032850f40de027e2dbaa3b250af2babc1549b8f8fa72c52e868743ba43e183f50c8b9d8ce45d0acf64758fd65edb776199ee84c6da0d228e0627e0ea92949e4dc6ef5f023b7c6e1a9d261384fa4db33962341c330b710405b1a339209fdfc6cb2eb29a7fb3ccbe4a1c7e2daf4f6f1c227ed4b77384938d082f59bfee13585ca9fc46c232f62ebb6287c3e02018313f22c0c8096a37c1506873294ede68b3eba8cc66ca31f40f0d19ff1536fd8fb42b3ff2fa3b191194d6d04e2d056b0c3c0c4abd88bc1c7e4c5b1e7b31245acebf616d2746d461c8a75ae762b2df0862c7705f2cad59f00303afaa9d9e774d005eecb3fe80c5bee4266703c2981803d7aad43c42d312e9376fc2a03b3a9067e88e1a4c063646493a63cc95082ad51505176a7dda5b4493dbc78a4021f6a0d31868d75ee08bb6129e84f247eb3ad352ec045c8d5dc8ee5ad7b7eae948ae056f523a4745f3839cb763505afe12e8b0a988caba151b38549e06738a15dfec6a5597b31f47fbbcb622b4b6dce331b50a4a7561396da5e3cd3383840afc00ac0537bf03a8aab179330a38d15115a01b0db44c9302bc908a5d86c5acef4859fc7464a0e4f2970f4221bffdd617bff126e6256cfbd24be7dc1eee65996013cd23a184ba66c7c0cdeb6b551fab006fda43591645106cf836bed95c143df06918fc0a3c32f6eea50a5208550fb42503987e64571d718b751597998d76941feed27076b64492eea782db891df0f69e89a6211d584f9f9c7d090ec9f6dd70a590436dfa4790a534bdfc1f46fd1ddbbcee124cd9668d968d95add753b630262989cf986b146722242b17cb2bbb083b590ab4946cf25326024a6d4377a9988a3335a84e0eba9c4287cf5fd3304e11cba1119c22a6ae371aa82cd398499a80be864159c08b6925ecc3d25b2aa9a841a5131123e09697cc5e516e9a117b6e86a6ebee3bb39f0801ffcc65f1acbd69f8cab1a1ec921d144366af2049aac2d58cbc20333d1fd63695891d50209e50a281f3a1906d8d12b5dd1610c307901d6283db0e8833bb63714785332cc03f28111d64a6649267da73ef1d9ebb0bd584fd651cce2518ce7bf40c48b07d6f50b1aa224d656d1cd8db83f250ddac303ff8076a4c151abacb7ceb18b10cc3c3de6f929d3858074223765d0e0005606b550f4a00cc855a8d8a99dac57a4a8b15729638dd982aec22e79c42bf3b5f67fe2ab4632acadc954444fb54806d730880b48cb10d641f3b607e6413d106c0622ba4670c169c0bc3073cf6bf160e7989b78aaae81e7306727c2d13776d827a209a4a84805f2b8f5bbf2950e9d213a344f236c9dfbfe0a4fed7eb5d27d3bb15e89d454bc3dc83df918e57e8b4c763aeabdd00cd768b69a052e848694b97cef6c333eed2d3278cefa13c73c4d1b886c1c23c3a9a5533d4f0aea3416fb0054a42c3b61ec6eebd0cadff6106cc7b58e2b5aefd2d9482d37cdbc04cfff4e8efde9397598d3f164483613391be5d96eab911ab979c9418b26abcf05d14e1c1fc84a943829d3a84d08ea171034c60a953fca50fb373aa1ffe26cf1ed8f1e2b64b50f05f22af000ccdfc87fc5d999ee0d5ade3e1438747a55ac95482b6619c4bf41dea7d164aaa6922b2f563a95ac5f4b906c3bc8172a184e7d28a1e10e0a38455a4a326610b41da0e48fcd60be7417b9a92ad92ecc6068dbcb93543f02c1ca310d45d118869e06169f2164d4ce5a6f96a5b8b75bbcd945c8f7e947cb435051fcf6f8f8244269b4d3412aaf91374b18f385ba052eedd9613793a9d1382d30b912f0af55bd3b7a821fb1fc32c62434970afd2af33707487beb86fae9a927e1a10e20803ff58bf02213ff4b019df223589710d2fb436a930c009e513cec0a3733badfb7c183bb4fe18f3c1f3efabc18629462fb16a82aaae57e976f233d8debf50c6f2b7b1e53870103bcd4ce8ed53e5effffccd5fb0d45a235a326aa3d4381d9031b25913203b8eb2f170e30f4e324db5fd01e0ae5b86dd48a27aba37871fb7d3f4be672f1191bca2516d2c17a9aaba68ffa02fb999f7441e7238341fbea72a00b7f9f9acbca02a3157984f7a88ec809c1083dddec5151bedc6892d77cbb0f878ff2bbdb61922daaaf99a419bb9aaf41c2e49f9470dee0fbac03b84272626eb1e11b37b3b9d735df63f08965d3cd2bcdda5d34fe7919c976702a01d9a18bf6b1d2cc5ba4d78bb38634198003cf17a33e17391b3e0ff25368e8adf469861496dcd5868d163a2087c584df9874f4185752cc16ebdb852d60932ece37096301a718b7489f3688848996b649775533aa55918327ca1b5de7abb448c178d98e7e13cd4ce939326edefeb9ea6bb65fb6131cf0749425df1afb553411dad6041232ff4493aa644624b960badd643ebbd84e7c80bcf9acd1aa3bcb0bac9208b05098c6005b8", 0xc36}], 0x2, &(0x7f0000000b40)}}], 0x1, 0x4000081) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r2, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) executing program 4: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000000c0)={0x84, @local, 0x15, 0x3, 'fo\x00', 0x1, 0x0, 0x69}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000380)={{0x84, @rand_addr=0x64010104, 0x4e24, 0x3, 'nq\x00', 0x8, 0x5, 0x55}, {@remote, 0x4e22, 0x0, 0x7, 0x12d5c, 0x12d58}}, 0x44) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0}, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000001c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-generic)\x00'}, 0x58) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004c80)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000940)="1beb41ea4ea9ca354f167d9eaee7dc35eca218b865688d79fe31cbe00d190c853bfe6a22bd7dec0023aa0e038d07000040e37e00f7dd3afafdbc70e1b5928033df5e82fd76f31e8b29a0f05c2cef56f56cd0330dc984004f220b7dcb23a0", 0x5e}, {&(0x7f0000000b00)}], 0x2, 0x0, 0x0, 0x4004090}, {0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000c00)}], 0x1, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000000640)=[{0x0}, {&(0x7f0000000fc0)}], 0x2, 0x0, 0x0, 0x84090}], 0x3, 0x4004000) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f00000006c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x3, 0x0, 0x7, 0x0, 0x0, 0x0, 'syz0\x00', 0x0}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="b700000000000000070000000000000095000000000000001e5286574356940658273ad1326fc65be4b1037a74cfb5af100fc4e94d123d9b22a7561b8850821bc1f8b5b0a3e3b79b0d96ab7cc60e0e144f0f04bfffe68fe46421a161eedd1a5cee316f68f7617859f06c8efd5da6abe446649c322209b1af93c6c999058168ad0a70992124d19c7c9cc22ff9a6b1a058039ab938480e8697f8715bcb18e1fd0773909464a783148e0e7b604a6c47b33c43a3ffff92ec8bbde1af40f29cfcf0836a70a2f6b1192ab8f24ca363492393e1c2a3b190180caafbf8cfca720074bdcc7cbd978efd8404a1c776001f78d97813926b19446ac8f823402eea2bdeaf5e99514e64e36cad5eba82010b2d149aa72e5f070000000000000000000000000000000000003a4a00009d5df0e0dbb9821d9c5402474d5866ce5eb60188d83ac741b45aeacac594cf09de9b460f48b96ae8a0eead478e46c8ca3e4c5d2b3cb4ad480100000000000000dcbf36b7e8be59ca4b46266cf75bea8a22ab71895d954dc6d28864144c73391770690a9301cde97565d5000000000000000455355d5d55f551df82ea475a711ec56d00000000507c093f4fad7095fbec5b005ebb710d87"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x48) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) executing program 3: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0a00000007000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @dev={0xac, 0x14, 0x14, 0xf}, 0x15, 0x3, 'lblcr\x00', 0x1, 0x6, 0x48}, 0x2c) socket$kcm(0xa, 0x2, 0x0) r1 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r1, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010102, 0x4e21, 0x3, 'lc\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x10000, 0xc, 0x2}}, 0x44) sendmsg$sock(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r2 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADDDEST(r2, 0x0, 0x487, &(0x7f0000000000)={{0x84, @loopback, 0x4e21, 0x3, 'lblcr\x00', 0x0, 0x81, 0x39}, {@rand_addr=0x64010500, 0x4e25, 0x3, 0xc3, 0xfffffff8, 0x12d5c}}, 0x44) r3 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r3, &(0x7f0000000400)={&(0x7f0000000140)=@in6={0x2, 0x15, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) write(r0, &(0x7f0000000600)="b7a27258eeb57eb735b6ed1bf5b29ebb2d5240787de075bdc2cf36967267e224fcbbcf968165848fb7e50964120f70981723b2c434c501ad1e450f9c8363f37485056c46930d3e3ada1f563942d9c3cfe84ed8816a3c6edba12715c196aec86f1ada73dae005f27fa073cca78c0a6e1433d1b68fae9cf3cc9248e284b9261101022ce604d6c37402dd50095d16d930915ed390bb1eb5eda8d625af17ba1b439097c46c82d24da04e26a767cf7b7dc9d2089ed3a128951f5b7a9c7bc05003d0c60c9a226a3aa64f52c7a083396874c996dd046b10e543c5434e08d5dcd17e2be8cfaec24c5ec2d2cf69dd226d1a74146043ec58f51d152165237cc018baeeedcd307373234e7f723358ebce3676917a4d0e723822a66f6ae40311b4fcf6bf8b452cf88661f82d1c306638f875c02b08fd594325a1ccd492dd7c3abd5e807b08993cf3a1a9d27b618fd66e0baf5ed7168b515b7c5cbc28ccaef476a1cb94d8b677c1c38373de577326a0f28db3c966e89f37ba64b0816539d7862aecb13b63bfadcc1615fe0c8c4ca8681754933d57568f642f0b10f8409fcc414fa29743346eab5d4efba1560be296c5ea584af830533cc83bbcb2a1536e069050db7ffe37e970504db09020cee2a1da136dcbf9b5ab27da2050b44cbb36690e3fade327783a3d0cceca374876d91a6b6001a8f06b7e4294f638b7eac5da085654fd7f5ecd3490d436288da5509cb8b9d3384d92e6cc5c1a611db2af9ab52f72c426a8e843fa160ddc7e1da0d2db4154389f8a07d2e9b2605549621b8cc71ea25b0983a7f07d9f370706559071ee1ab25cec05901f1da668de618f9ff3e6a76fd6f3d44dfb77ce2dc3b46a113adf0165e191967e3393e3ca023c0154541436f6d689001aab8be55b0751e51506f5f1bd908effc1acfcd7d07fda4ac30e396bee77b4d8f730ccdc95d0759e1e367a7aeb9888e471070456fa36cf66ddc5e783bddbabeff8c09f6d163b169db894d30e795df7688a6c4b1c4106dc5f2c149b74eabc9727f20ab7ad53c1252678c0be13ba179dc4bc580a99109c8ae8ec361eb0401a77bcc333fb150600790b048b1400b0be2378fd28a03c2fa7d75023c4ac16543593885163acd8f63ccc5859feec7dd0f5fe8f1cb1dad71a79ec636166162a4a2a14700932bbb86123a1a725ed5b31fcc5c824f8bb50c18b8ffd236bb1d712977375a7f47ded4e19dc02b00f11263e933d0c6965c748864066e65ada7c1fe31319dd87550979c0db5063342f70847b6eef4c4a2b23a8e42980a91ebaa8e4712b7aef0f7bc94538cb7229adc5259d10d9f92612af0ebb1d38112d32c7eae56ef08c631dbc277fc61a7daaaebd50ec87764b8e7456e160d7287aeb9702f16c5a38660e32cb4a1a18325605e9eb79bd038c3f50d47e489a1bdd5ed21d66188dff625cafe0f82a0367e70c3de0f3cfcce49a99646fec1670c351c3b31a5e7291a4508b3e21afe698f089e038f81f05658629c1008c3efc8a87f947f018138f68fabc7dd8260857efe6a6e4b035da3a80818a4cd305dc887550ae99da8b6dfff5b286f94527f12c4c24f7b31da274076a90e5cfc1078dc0da07b0378eb14ac4419803b9e6f4ad5fdd5662bf83862db6bd741cb3a4e55a3fbcd91524b27fc0f78f27d67872f33aa9c2dfeb2fd63990a8c396ce17807f2f996fae162c02c8a0accd0ce6ccce730d26dce8e0ec7c3f6da7ec4a4f8123e151500b49c8567ffe02d186e35d004ba920e1c6bbdf7960019ef7e229eac766cfdec721eb980ca0c8f825e4ab7a401747044a252fec53fdf054e0927997eb4120e7fd80fd9db7721ba6db538ac046885d308c8486ff67606baf32810b0147f3c88efb03daf7663f650cba7a5043c1e9f397f6aade481e6d69d9d2a222125941947e12f0008330cd9d6bf9eac09c02089638d89d7b5128a4df1781ffa570a971435091687bcccf034066201ebec67858126b3a98d1437c8fe7af3741118e024803a68836f7cf4f23e5ec44e0079f3123ad1715f71dfdb6cbd86c1c288cec9f9d6aae8a6b4d6fe85341eb67bb5a0a43bf75fd1ce7898a18dd11dac7eb604af235333b55ac1d4ec74756bb8d8b00632d0979ebca10e69a2c8bae6f874cf5d2a94a77ccc8c5ef3b88971aa982690ea4d9d7e1992400ec5dc1b966ee9535bda5a152c656c0675d411a86c4db394e8305fb08fe4866c39a7b48652f6c9262c9d54ebadf3e9063ac01eaff635d1b8cba72107abf13a8143531fd502bdecabd068f9396673c3112873d1b3bd48166d2057fc13a3abe827ad80cc110c16d37dd85590171f4aca89cef3e04420352a9264f31aecb212ae982f25b04c82345cba64880c705970ff5c191183494a3761831fe8f6728505a956fdcdc8084fd1f6dc56b54723600358d65a6b7d74238d762ceae8531c78e97fbae63018c8bc74855f8a02acb4b4c35d72397c019c927d61b60ef1931e7e39318ac0fdcd24e740c7902a7b3081263b8a8a3260b4cab4ca5feae236e449d84218fa8b11e11c128c36d1937262559067a08d316195f895a13bba21c89731560ed32a84849bd59f36cc7849e0529dd594f53b08bf1fa466800f375c0ca21f8dac0054b432662ec9e5b40447782d8e059863494ac42d2c64850c2753846a6db9bb26161feda3a0c8fb414df6af1c1e122383f7f18907eddb79cc0c19ecbe25ea280302f9b579f70f136d3b4289724775a1d2dc37a589b69d5dec01cea0969ba9c8db9d40aaf869d6e75193b4358d1fca6634b96f20da91eeff60a2e626d5c086fd8d308b6ce5cb75abad6083f58f775171fff767a3204cdf1e76713be1882deb686cea967134f01795f182ceff162348e6bca107b5effb73bb8", 0x7f5) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000008000)={0x15, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="b700000000000000070000000000000095000000000000001e5286574356940658273ad1326fc65be4b1037a74cfb5af100fc4e94d123d9b22a7561b8850821bc1f8b5b0a3e3b79b0d96ab7cc60e0e144f0f04bfffe68fe46421a161eedd1a5cee316f68f7617859f06c8efd5da6abe446649c322209b1af93c6c999058168ad0a70992124d19c7c9cc22ff9a6b1a058039ab938480e8697f8715bcb18e1fd0773909464a783148e0e7b604a6c47b33c43a3ffff92ec8bbde1af40f29cfcf0836a70a2f6b1192ab8f24ca363492393e1c2a3b190180caafbf8cfca720074bdcc7cbd978efd8404a1c776001f78d97813926b19446ac8f823402eea2bdeaf5e99514e64e36cad5eba82010b2d149aa72e5f070000000000000000000000000000000000003a4a00009d5df0e0dbb9821d9c5402474d5866ce5eb60188d83ac741b45aeacac594cf09de9b460f48b96ae8a0eead478e46c8ca3e4c5d2b3cb4ad480100000000000000dcbf36b7e8be59ca4b46266cf75bea8a22ab71895d954dc6d28864144c73391770690a9301cde97565d5000000000000000455355d5d55f551df82ea475a711ec56d00000000507c093f4fad7095fbec5b005ebb710d87"], &(0x7f0000003ff6)='syzkaller\x00', 0x1, 0xc3, &(0x7f00000002c0)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_reuseport}, 0x48) r0 = bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) close(r0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r3, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x3) close(0x4) bpf$ITER_CREATE(0xb, &(0x7f0000000100), 0x0) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r4, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) close(0x4) executing program 4: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000040)={0x84, @broadcast, 0x11, 0x3, 'none\x00', 0x1, 0x6, 0x4e}, 0x2c) r1 = socket$kcm(0xa, 0x2, 0x0) socket(0xb, 0xa, 0x3f0b8395) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @dev}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 7, 4, 7, 6, 16, 15, 7, 28, 9, 28] detailed listing: executing program 0: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty, 0x3}, 0x1c) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_udp_encap(r1, 0x11, 0x64, &(0x7f0000000040)=0x2, 0x4) write$tun(r0, &(0x7f0000000080)={@val={0x8, 0x800}, @val={0x0, 0x1, 0x6, 0x4, 0x2f, 0x40}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x28, 0x29, 0x66, 0x0, 0x40, 0x11, 0x0, @private=0xa010102, @dev={0xac, 0x14, 0x14, 0x26}}, {0x4e26, 0x4e20, 0x15, 0x0, @gue={{0x2, 0x0, 0x3, 0x5, 0x0, @val=0x80}, "7982d60305"}}}}, 0x37) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000340)=@newtfilter={0x8c, 0x2c, 0xd27, 0x70bd28, 0x25dfdc00, {0x0, 0x0, 0x0, r3, {0x0, 0x10}, {}, {0xfff2}}, [@filter_kind_options=@f_matchall={{0xd}, {0x58, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x2, 0x2, 0x20000000, 0x100000a, 0x8}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x2, 0x3}}}}]}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)={0x38, r1, 0x5, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_MESH_SETUP={0x10, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x20000084}, 0x0) executing program 4: bpf$ENABLE_STATS(0x20, 0x0, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000b00)=ANY=[@ANYBLOB="0a00000007000000ff0f000007"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000180)=r1, 0x4) sendmsg$inet(r3, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x20000000) executing program 4: r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r0, 0x29, 0x35, &(0x7f0000000000)=0x8000, 0x4) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000140)=ANY=[], 0x8) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, &(0x7f0000000540)=[{{0x0, 0x0, 0x0}}], 0x1, 0x2, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) executing program 2: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000000c0)={0x84, @local, 0x15, 0x3, 'fo\x00', 0x1, 0x0, 0x69}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000380)={{0x84, @rand_addr=0x64010104, 0x4e24, 0x3, 'nq\x00', 0x8, 0x5, 0x55}, {@remote, 0x4e22, 0x0, 0x7, 0x12d5c, 0x12d58}}, 0x44) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000dc0)=ANY=[@ANYRES32, @ANYBLOB="0800c3"], 0x33fe0}, 0x1, 0x0, 0x0, 0x40002}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004c80)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000b00)}], 0x1, 0x0, 0x0, 0x4004090}, {0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000540)="d21e61c0af08368aedabcf6e445f1ca30a2f37d1f6d14042afeb21e49b0da7fd9f", 0x21}, {&(0x7f0000000c00)}], 0x2, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000000640)=[{0x0}, {&(0x7f0000000fc0)}], 0x2, 0x0, 0x0, 0x84090}], 0x3, 0x4004000) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f00000006c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x3, 0x0, 0x7, 0x0, 0x1, 0x0, 'syz0\x00', &(0x7f0000000680)=['']}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b922, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xe, 0xb}, {0xf, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) close(r5) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x1e) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x304}, "3a9badf933cbd4a5", "f568be9086150c45fb95a5e557f520c287f0a2f14d34ef1e24b3046bba0aff40", "82703436", "5b29230ec59329e6"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) close(r0) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r9) sendmsg$NBD_CMD_CONNECT(r9, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r9) getsockopt$inet_udp_int(r8, 0x11, 0x6c, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(0x0, r5) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x4, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8990, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') socket$l2tp6(0xa, 0x2, 0x73) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r1 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x61d0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYRES32=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000824}, 0x8040) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: split chunks (needed=true): <10> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 15, 7, 28, 9, 28] detailed listing: executing program 2: setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f00000000c0)={0x84, @local, 0x15, 0x3, 'fo\x00', 0x1, 0x0, 0x69}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(0xffffffffffffffff, 0x0, 0x487, &(0x7f0000000380)={{0x84, @rand_addr=0x64010104, 0x4e24, 0x3, 'nq\x00', 0x8, 0x5, 0x55}, {@remote, 0x4e22, 0x0, 0x7, 0x12d5c, 0x12d58}}, 0x44) bind$alg(0xffffffffffffffff, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'cts(cbc(serpent))\x00'}, 0x58) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$alg(0x26, 0x5, 0x0) sendmsg$NL80211_CMD_VENDOR(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000dc0)=ANY=[@ANYRES32, @ANYBLOB="0800c3"], 0x33fe0}, 0x1, 0x0, 0x0, 0x40002}, 0x0) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000004c80)=[{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000b00)}], 0x1, 0x0, 0x0, 0x4004090}, {0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000000540)="d21e61c0af08368aedabcf6e445f1ca30a2f37d1f6d14042afeb21e49b0da7fd9f", 0x21}, {&(0x7f0000000c00)}], 0x2, 0x0, 0x0, 0x1}, {0x0, 0x0, &(0x7f0000000640)=[{0x0}, {&(0x7f0000000fc0)}], 0x2, 0x0, 0x0, 0x84090}], 0x3, 0x4004000) bind$alg(r1, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-asm\x00'}, 0x58) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(0xffffffffffffffff, 0xc1105517, &(0x7f00000006c0)={{0x0, 0x0, 0x0, 0x0, 'syz0\x00'}, 0x3, 0x0, 0x7, 0x0, 0x1, 0x0, 'syz0\x00', &(0x7f0000000680)=['']}) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r2 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r2, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000005c0)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b922, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {0xe, 0xb}, {0xf, 0xffe0}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040e0}, 0x4890) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, 0x0, 0x0) close(r5) socket$netlink(0x10, 0x3, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@gettclass={0x24, 0x2a, 0x129, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {0x1, 0x3}, {}, {0x8, 0xfff1}}}, 0x24}}, 0x40004) executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000240)=0x100000001, 0x59) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e22, 0xb7, @ipv4={'\x00', '\xff\xff', @local}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000040), 0x1e) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f00000000c0)=@gcm_256={{0x304}, "3a9badf933cbd4a5", "f568be9086150c45fb95a5e557f520c287f0a2f14d34ef1e24b3046bba0aff40", "82703436", "5b29230ec59329e6"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, 0x0, 0x0) close(r0) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r9) sendmsg$NBD_CMD_CONNECT(r9, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r9) getsockopt$inet_udp_int(r8, 0x11, 0x6c, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(0x0, r5) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x4, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8990, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') socket$l2tp6(0xa, 0x2, 0x73) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r1 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x61d0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYRES32=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000824}, 0x8040) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 9, 28] detailed listing: executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r9) sendmsg$NBD_CMD_CONNECT(r9, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r9) getsockopt$inet_udp_int(r8, 0x11, 0x6c, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(0x0, r5) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x4, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8990, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') socket$l2tp6(0xa, 0x2, 0x73) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r1 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x61d0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYRES32=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000824}, 0x8040) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 28] detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x5) close(0x4) r0 = syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/cgroup\x00') socket$l2tp6(0xa, 0x2, 0x73) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x215eb000) r1 = socket(0x14, 0x2, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x61d0, 0x0) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYRES32=r0], 0x1c}, 0x1, 0x0, 0x0, 0x20000824}, 0x8040) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 28] detailed listing: executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r9) sendmsg$NBD_CMD_CONNECT(r9, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r9) getsockopt$inet_udp_int(r8, 0x11, 0x6c, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(0x0, r5) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x4, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8990, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: split chunks (needed=true): <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 2 programs left: executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r9) sendmsg$NBD_CMD_CONNECT(r9, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r9) getsockopt$inet_udp_int(r8, 0x11, 0x6c, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(0x0, r5) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x4, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8990, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, 0x0, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) bisect: trying to concatenate bisect: concatenate 2 entries minimizing program #0 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [27, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r9) sendmsg$NBD_CMD_CONNECT(r9, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r9) getsockopt$inet_udp_int(r8, 0x11, 0x6c, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(0x0, r5) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x4, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) ioctl$sock_ifreq(0xffffffffffffffff, 0x8990, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [26, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) r7 = syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) r8 = socket$inet_udplite(0x2, 0x2, 0x88) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r9) sendmsg$NBD_CMD_CONNECT(r9, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r9) getsockopt$inet_udp_int(r8, 0x11, 0x6c, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(0x0, r5) ioctl$sock_rose_SIOCADDRT(r7, 0x890b, &(0x7f0000000380)={@remote={0xcc, 0xcc, 0xcc, 0xcc, 0x0}, 0x6, @null, @bpq0, 0x4, [@bcast, @bcast, @bcast, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r8) sendmsg$NBD_CMD_CONNECT(r8, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r8) getsockopt$inet_udp_int(r7, 0x11, 0x6c, 0x0, 0x0) syz_genetlink_get_family_id$l2tp(0x0, r5) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) r7 = socket$inet_udplite(0x2, 0x2, 0x88) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r8) sendmsg$NBD_CMD_CONNECT(r8, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r8) getsockopt$inet_udp_int(r7, 0x11, 0x6c, 0x0, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [23, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r7) sendmsg$NBD_CMD_CONNECT(r7, 0x0, 0x0) syz_genetlink_get_family_id$ieee802154(0x0, r7) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [22, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r7) sendmsg$NBD_CMD_CONNECT(r7, 0x0, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [21, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, r7) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [20, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) socket$inet_udplite(0x2, 0x2, 0x88) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [19, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) socket$inet_udplite(0x2, 0x2, 0x88) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [18, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, 0x0, 0x0) r6 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r6, 0x0, 0x3, 0x0, 0x0) write(r2, 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r5, 0x84, 0x1, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r1, 0x84, 0x1b, &(0x7f0000000480), 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [17, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, 0x0, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r5, 0x0, 0x3, 0x0, 0x0) write(r1, 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) getsockopt$inet_sctp6_SCTP_ASSOCINFO(r4, 0x84, 0x1, 0x0, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, 0x0, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r5, 0x0, 0x3, 0x0, 0x0) write(r1, 0x0, 0x0) syz_init_net_socket$rose(0xb, 0x5, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, 0x0, 0x0) r5 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r5, 0x0, 0x3, 0x0, 0x0) write(r1, 0x0, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, 0x0, 0x0) r4 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) setsockopt$WPAN_WANTLQI(r4, 0x0, 0x3, 0x0, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, 0x0, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) r3 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r3, 0x10e, 0xc, 0x0, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) socket(0x10, 0x3, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(0xffffffffffffffff, 0x8914, &(0x7f0000000000)) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) bpf$PROG_LOAD(0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x11}}, 0x1e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 28] detailed listing: executing program 0: socket$inet_tcp(0x2, 0x1, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 28] detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 1: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release minimized 28 calls -> 5 calls minimizing program #1 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 27] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 26] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @default]}) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 25] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_addr_ax25dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 24] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) r8 = openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) write$rfkill(r8, 0x0, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 24] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) openat$rfkill(0xffffffffffffff9c, &(0x7f00000000c0), 0x200, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_addr_ax25dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 23] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'lo\x00'}) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_addr_ax25dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 22] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r7, 0x89f1, &(0x7f00000002c0)={'ip6_vti0\x00', &(0x7f0000000200)=@ethtool_rxfh_indir={0x39, 0x4, [0x34, 0x7, 0x2, 0xff]}}) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_addr_ax25dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 21] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_addr_ax25dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 20] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) bind$ax25(r6, &(0x7f0000000100)={{0x3, @default, 0x1}, [@bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_addr_ax25dev testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 19] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 18] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) socketpair$unix(0x1, 0x1, 0x0, 0x0) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 18] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = socket(0xa, 0x3, 0x3a) r5 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r5, 0x8b2c, &(0x7f0000000040)) bind$alg(r4, &(0x7f0000000240)={0x26, 'aead\x00', 0x0, 0x0, 'ccm_base(lrw-twofish-3way,sha384-generic)\x00'}, 0x58) r6 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 17] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) socket(0xa, 0x3, 0x3a) r4 = socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) ioctl(r4, 0x8b2c, &(0x7f0000000040)) r5 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 16] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) socket(0xa, 0x3, 0x3a) socket$qrtr(0x2a, 0x2, 0x0) ioctl$sock_inet_SIOCSIFPFLAGS(0xffffffffffffffff, 0x8934, &(0x7f0000000040)={'virt_wifi0\x00'}) r4 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r4, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 15] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) socket(0xa, 0x3, 0x3a) socket$qrtr(0x2a, 0x2, 0x0) r4 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r4, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 14] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) socket(0xa, 0x3, 0x3a) r4 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r4, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 13] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000900)={r2, &(0x7f0000000540)="c279a3fc9c31efb78410a0b7a0c142f1ff66dbfdcd684e1da60c98760ae0c6c1084fba69a1436890bc81ba2eda86b185b2e50ff29117f945a5629c88a4215b92d4b495c49c2d7dccf6b6524991210400000000000000e4380e4df2d937f9ce816dd94d4f5a78e6ec21ca1311906392271f"}, 0x20) r4 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r4, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 12] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, {0xa, 0x4e22, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x0, {[0x2cb6, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000000]}}, 0x5c) r4 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r4, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 11] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r3, 0x1, 0xf, 0x0, 0x0) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000440)={r2, &(0x7f0000000240), &(0x7f0000000080)=@tcp=r3}, 0x20) r4 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r4, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 10] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, 0x0, 0x0) r3 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 9] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) socket$inet_tcp(0x2, 0x1, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 8] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYRES8=r1, @ANYRES32, @ANYRESHEX=r0, @ANYRES32, @ANYBLOB="000000000000000000000000000000000000000000000000000000007d863d69590549faafb6fdf0e8ae5f94f93de358014e8e1f4013dae31198b6e51e540a5853f359e75b223fd54249b16ba5ac4d4b67ebced194175b791395f3704e2bb32a9bfa5aeed1f9d0faba8e9dfa87712e8dcb957b3a0e3f4acebdcc29c79ac41d80fb919c56787e265d8ad036ad419887f3a5471d53bc3e87f7b33973b70911f7f01cd3d154d888500679c1203ffb542e75d192290c9a8b2b7c57d9446311697a0ab61066c1ce6386fa2fb29f4e4910fb3abb49b8a8b0f8e5d3a1726ec49bcea2afd64d45d19299174f83f4f23a43"], 0x48) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 7] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 6] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xa, 0x4, &(0x7f0000000000)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x10}]}, &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 5] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000180)=[@in={0x2, 0xce21, @dev={0xac, 0x14, 0x14, 0x1c}}], 0x10) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 4] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000140)=0x8, 0x4) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 3] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: socket$inet_sctp(0x2, 0x1, 0x84) r0 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 2] detailed listing: executing program 3: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) executing program 0: r0 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r0, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb minimized 28 calls -> 2 calls testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_release bisect: concatenation succeeded found reproducer with 7 syscalls minimizing guilty program testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25 detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) syz_init_net_socket$ax25(0x3, 0x5, 0x0) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(0xffffffffffffffff, 0x8914, &(0x7f0000000000)) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r1 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, 0x0, 0x0) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb simplifying C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f0000000240)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb validation run: crashed=true reproducing took 2h18m38.743546733s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] BUG: KASAN: use-after-free in ax25_fillin_cb+0x459/0x640 net/ax25/af_ax25.c:495 Read of size 4 at addr ffff88802ac8c238 by task syz.0.19/4323 CPU: 1 PID: 4323 Comm: syz.0.19 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 print_address_description+0x60/0x2d0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xdf/0x130 mm/kasan/report.c:451 ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] ax25_fillin_cb+0x459/0x640 net/ax25/af_ax25.c:495 ax25_setsockopt+0x8c9/0xa60 net/ax25/af_ax25.c:690 __sys_setsockopt+0x2bf/0x3d0 net/socket.c:2212 __do_sys_setsockopt net/socket.c:2223 [inline] __se_sys_setsockopt net/socket.c:2220 [inline] __x64_sys_setsockopt+0xb1/0xc0 net/socket.c:2220 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f6f78ad5f79 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd72dd43e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007f6f78d4ffa0 RCX: 00007f6f78ad5f79 RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000007 RBP: 00007f6f78b6c7e0 R08: 0000000000000010 R09: 0000000000000000 R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6f78d4ffac R14: 00007f6f78d4ffa0 R15: 00007f6f78d4ffa0 Allocated by task 4321: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xb5/0xf0 mm/kasan/common.c:522 kmalloc include/linux/slab.h:607 [inline] kzalloc include/linux/slab.h:738 [inline] ax25_dev_device_up+0x50/0x580 net/ax25/ax25_dev.c:55 ax25_device_event+0x483/0x4f0 net/ax25/af_ax25.c:139 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:391 call_netdevice_notifiers_extack net/core/dev.c:2074 [inline] call_netdevice_notifiers net/core/dev.c:2088 [inline] __dev_notify_flags+0x194/0x300 net/core/dev.c:8904 dev_change_flags+0xe3/0x1a0 net/core/dev.c:8942 dev_ifsioc+0x130/0xd50 net/core/dev_ioctl.c:324 dev_ioctl+0x545/0xe30 net/core/dev_ioctl.c:572 sock_do_ioctl+0x245/0x320 net/socket.c:1161 sock_ioctl+0x4d2/0x710 net/socket.c:1266 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 4322: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1710 [inline] slab_free_freelist_hook+0xea/0x170 mm/slub.c:1736 slab_free mm/slub.c:3504 [inline] kfree+0xef/0x2a0 mm/slub.c:4564 ax25_dev_put include/net/ax25.h:302 [inline] ax25_release+0x661/0x870 net/ax25/af_ax25.c:1062 __sock_release net/socket.c:651 [inline] sock_close+0xd5/0x240 net/socket.c:1345 __fput+0x234/0x930 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff88802ac8c200 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 56 bytes inside of 192-byte region [ffff88802ac8c200, ffff88802ac8c2c0) The buggy address belongs to the page: page:ffffea0000ab2300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ac8c flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888016c41a00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 4321, ts 67561495906, free_ts 67296456812 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x1bbd/0x1ca0 mm/page_alloc.c:4192 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5487 __alloc_pages_node include/linux/gfp.h:570 [inline] alloc_slab_page mm/slub.c:1782 [inline] allocate_slab mm/slub.c:1917 [inline] new_slab+0xb6/0x4b0 mm/slub.c:1980 ___slab_alloc+0x80a/0xdd0 mm/slub.c:3013 __slab_alloc mm/slub.c:3100 [inline] slab_alloc_node mm/slub.c:3191 [inline] __kmalloc_node+0x200/0x3b0 mm/slub.c:4456 kmalloc_array_node include/linux/slab.h:700 [inline] kcalloc_node include/linux/slab.h:705 [inline] memcg_alloc_page_obj_cgroups+0x81/0x120 mm/memcontrol.c:2839 memcg_slab_post_alloc_hook mm/slab.h:313 [inline] slab_post_alloc_hook+0xba/0x380 mm/slab.h:526 slab_alloc_node mm/slub.c:3225 [inline] slab_alloc mm/slub.c:3233 [inline] kmem_cache_alloc+0x100/0x290 mm/slub.c:3238 __d_alloc+0x2a/0x6f0 fs/dcache.c:1749 d_alloc fs/dcache.c:1828 [inline] d_alloc_parallel+0x7b/0x1330 fs/dcache.c:2584 __lookup_slow+0x134/0x410 fs/namei.c:1656 lookup_slow+0x53/0x70 fs/namei.c:1688 walk_component+0x319/0x460 fs/namei.c:1984 link_path_walk+0x665/0xd70 fs/namei.c:-1 path_openat+0x28d/0x2fa0 fs/namei.c:3746 do_filp_open+0x1e2/0x410 fs/namei.c:3777 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare mm/page_alloc.c:1391 [inline] free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xd0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519 slab_alloc_node mm/slub.c:3225 [inline] slab_alloc mm/slub.c:3233 [inline] __kmalloc+0x127/0x330 mm/slub.c:4408 kmalloc include/linux/slab.h:612 [inline] kzalloc include/linux/slab.h:738 [inline] fib6_info_alloc+0x2e/0xe0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x44f/0x1210 net/ipv6/route.c:3769 ip6_route_add+0x24/0x130 net/ipv6/route.c:3865 addrconf_add_mroute net/ipv6/addrconf.c:2510 [inline] addrconf_add_dev+0x295/0x3c0 net/ipv6/addrconf.c:2528 addrconf_dev_config net/ipv6/addrconf.c:3405 [inline] addrconf_init_auto_addrs+0x6a0/0xb00 net/ipv6/addrconf.c:3493 addrconf_notify+0xa6b/0xf00 net/ipv6/addrconf.c:3662 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:391 netdev_state_change+0xe0/0x160 net/core/dev.c:1453 linkwatch_do_dev+0x10d/0x160 net/core/link_watch.c:167 Memory state around the buggy address: ffff88802ac8c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88802ac8c180: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff88802ac8c200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802ac8c280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88802ac8c300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] BUG: KASAN: use-after-free in ax25_fillin_cb+0x459/0x640 net/ax25/af_ax25.c:495 Read of size 4 at addr ffff88802ac8c238 by task syz.0.19/4323 CPU: 1 PID: 4323 Comm: syz.0.19 Not tainted syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/24/2026 Call Trace: dump_stack_lvl+0x188/0x250 lib/dump_stack.c:106 print_address_description+0x60/0x2d0 mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xdf/0x130 mm/kasan/report.c:451 ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] ax25_fillin_cb+0x459/0x640 net/ax25/af_ax25.c:495 ax25_setsockopt+0x8c9/0xa60 net/ax25/af_ax25.c:690 __sys_setsockopt+0x2bf/0x3d0 net/socket.c:2212 __do_sys_setsockopt net/socket.c:2223 [inline] __se_sys_setsockopt net/socket.c:2220 [inline] __x64_sys_setsockopt+0xb1/0xc0 net/socket.c:2220 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 RIP: 0033:0x7f6f78ad5f79 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007ffd72dd43e8 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 RAX: ffffffffffffffda RBX: 00007f6f78d4ffa0 RCX: 00007f6f78ad5f79 RDX: 0000000000000019 RSI: 0000000000000101 RDI: 0000000000000007 RBP: 00007f6f78b6c7e0 R08: 0000000000000010 R09: 0000000000000000 R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f6f78d4ffac R14: 00007f6f78d4ffa0 R15: 00007f6f78d4ffa0 Allocated by task 4321: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xb5/0xf0 mm/kasan/common.c:522 kmalloc include/linux/slab.h:607 [inline] kzalloc include/linux/slab.h:738 [inline] ax25_dev_device_up+0x50/0x580 net/ax25/ax25_dev.c:55 ax25_device_event+0x483/0x4f0 net/ax25/af_ax25.c:139 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:391 call_netdevice_notifiers_extack net/core/dev.c:2074 [inline] call_netdevice_notifiers net/core/dev.c:2088 [inline] __dev_notify_flags+0x194/0x300 net/core/dev.c:8904 dev_change_flags+0xe3/0x1a0 net/core/dev.c:8942 dev_ifsioc+0x130/0xd50 net/core/dev_ioctl.c:324 dev_ioctl+0x545/0xe30 net/core/dev_ioctl.c:572 sock_do_ioctl+0x245/0x320 net/socket.c:1161 sock_ioctl+0x4d2/0x710 net/socket.c:1266 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl+0xfa/0x170 fs/ioctl.c:860 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x66/0xd0 Freed by task 4322: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4b/0x70 mm/kasan/common.c:46 kasan_set_free_info+0x1f/0x40 mm/kasan/generic.c:360 ____kasan_slab_free+0xd5/0x110 mm/kasan/common.c:366 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1710 [inline] slab_free_freelist_hook+0xea/0x170 mm/slub.c:1736 slab_free mm/slub.c:3504 [inline] kfree+0xef/0x2a0 mm/slub.c:4564 ax25_dev_put include/net/ax25.h:302 [inline] ax25_release+0x661/0x870 net/ax25/af_ax25.c:1062 __sock_release net/socket.c:651 [inline] sock_close+0xd5/0x240 net/socket.c:1345 __fput+0x234/0x930 fs/file_table.c:311 task_work_run+0x125/0x1a0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] exit_to_user_mode_loop+0x10f/0x130 kernel/entry/common.c:181 exit_to_user_mode_prepare+0xee/0x180 kernel/entry/common.c:214 __syscall_exit_to_user_mode_work kernel/entry/common.c:296 [inline] syscall_exit_to_user_mode+0x16/0x40 kernel/entry/common.c:307 do_syscall_64+0x58/0xa0 arch/x86/entry/common.c:86 entry_SYSCALL_64_after_hwframe+0x66/0xd0 The buggy address belongs to the object at ffff88802ac8c200 which belongs to the cache kmalloc-192 of size 192 The buggy address is located 56 bytes inside of 192-byte region [ffff88802ac8c200, ffff88802ac8c2c0) The buggy address belongs to the page: page:ffffea0000ab2300 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x2ac8c flags: 0xfff00000000200(slab|node=0|zone=1|lastcpupid=0x7ff) raw: 00fff00000000200 0000000000000000 dead000000000122 ffff888016c41a00 raw: 0000000000000000 0000000080100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x112cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY), pid 4321, ts 67561495906, free_ts 67296456812 prep_new_page mm/page_alloc.c:2426 [inline] get_page_from_freelist+0x1bbd/0x1ca0 mm/page_alloc.c:4192 __alloc_pages+0x1ee/0x480 mm/page_alloc.c:5487 __alloc_pages_node include/linux/gfp.h:570 [inline] alloc_slab_page mm/slub.c:1782 [inline] allocate_slab mm/slub.c:1917 [inline] new_slab+0xb6/0x4b0 mm/slub.c:1980 ___slab_alloc+0x80a/0xdd0 mm/slub.c:3013 __slab_alloc mm/slub.c:3100 [inline] slab_alloc_node mm/slub.c:3191 [inline] __kmalloc_node+0x200/0x3b0 mm/slub.c:4456 kmalloc_array_node include/linux/slab.h:700 [inline] kcalloc_node include/linux/slab.h:705 [inline] memcg_alloc_page_obj_cgroups+0x81/0x120 mm/memcontrol.c:2839 memcg_slab_post_alloc_hook mm/slab.h:313 [inline] slab_post_alloc_hook+0xba/0x380 mm/slab.h:526 slab_alloc_node mm/slub.c:3225 [inline] slab_alloc mm/slub.c:3233 [inline] kmem_cache_alloc+0x100/0x290 mm/slub.c:3238 __d_alloc+0x2a/0x6f0 fs/dcache.c:1749 d_alloc fs/dcache.c:1828 [inline] d_alloc_parallel+0x7b/0x1330 fs/dcache.c:2584 __lookup_slow+0x134/0x410 fs/namei.c:1656 lookup_slow+0x53/0x70 fs/namei.c:1688 walk_component+0x319/0x460 fs/namei.c:1984 link_path_walk+0x665/0xd70 fs/namei.c:-1 path_openat+0x28d/0x2fa0 fs/namei.c:3746 do_filp_open+0x1e2/0x410 fs/namei.c:3777 page last free stack trace: reset_page_owner include/linux/page_owner.h:24 [inline] free_pages_prepare mm/page_alloc.c:1340 [inline] free_pcp_prepare mm/page_alloc.c:1391 [inline] free_unref_page_prepare+0x637/0x6c0 mm/page_alloc.c:3317 free_unref_page+0x8f/0x2a0 mm/page_alloc.c:3396 qlist_free_all+0x35/0x90 mm/kasan/quarantine.c:176 kasan_quarantine_reduce+0x150/0x160 mm/kasan/quarantine.c:283 __kasan_slab_alloc+0x2f/0xd0 mm/kasan/common.c:444 kasan_slab_alloc include/linux/kasan.h:254 [inline] slab_post_alloc_hook+0x4c/0x380 mm/slab.h:519 slab_alloc_node mm/slub.c:3225 [inline] slab_alloc mm/slub.c:3233 [inline] __kmalloc+0x127/0x330 mm/slub.c:4408 kmalloc include/linux/slab.h:612 [inline] kzalloc include/linux/slab.h:738 [inline] fib6_info_alloc+0x2e/0xe0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x44f/0x1210 net/ipv6/route.c:3769 ip6_route_add+0x24/0x130 net/ipv6/route.c:3865 addrconf_add_mroute net/ipv6/addrconf.c:2510 [inline] addrconf_add_dev+0x295/0x3c0 net/ipv6/addrconf.c:2528 addrconf_dev_config net/ipv6/addrconf.c:3405 [inline] addrconf_init_auto_addrs+0x6a0/0xb00 net/ipv6/addrconf.c:3493 addrconf_notify+0xa6b/0xf00 net/ipv6/addrconf.c:3662 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0xcb/0x160 kernel/notifier.c:391 netdev_state_change+0xe0/0x160 net/core/dev.c:1453 linkwatch_do_dev+0x10d/0x160 net/core/link_watch.c:167 Memory state around the buggy address: ffff88802ac8c100: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ffff88802ac8c180: 00 00 00 00 00 fc fc fc fc fc fc fc fc fc fc fc >ffff88802ac8c200: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88802ac8c280: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc ffff88802ac8c300: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ==================================================================