Extracting prog: 8h49m47.501016552s Minimizing prog: 53m37.739906875s Simplifying prog options: 4m6.504940563s Extracting C: 2m6.182467208s Simplifying C: 0s extracting reproducer from 30 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-openat$tun-ioctl$SIOCGIFHWADDR-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-sendmsg$WG_CMD_SET_DEVICE-socket$nl_generic-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-pipe-socket$inet6-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$inet6-vmsplice-socket$inet6_mptcp-write$cgroup_devices-bind$bt_hci detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 4, 30, 20, 30, 5, 30, 14, 9, 27, 30, 10, 22, 30, 2, 30, 5, 40, 24, 3, 11, 20, 26, 7, 5, 3, 2, 15, 15, 30] detailed listing: executing program 1: openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000200018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) pipe(&(0x7f0000000000)) socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket(0x1, 0x803, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$rds(0x15, 0x5, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid_for_children\x00') r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000140)=ANY=[@ANYBLOB="44000000150a0309000000000000000000000008090001"], 0x44}, 0x1, 0x0, 0x0, 0x24000819}, 0x40008800) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r5, &(0x7f00000001c0)={&(0x7f0000000300)=@id, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000940)="5763f922081ae50887ede09da114c1daa077f9611f8aa81d1b6fa5f806897377d6aa8524a8b1d8c81597ae6a3411d62b43ead10f470c911e8223cee2d6745ff65b450f8b0b46f900c910f852", 0xff20}, {&(0x7f0000000280)="b57af26468ffde59db204ffaa467c0af523b9e6d93dd62dad3d2f90b45e80eb530982e2a1a0b9ebc2c7113d4f93982f87d0ced6312bdcaa996c13c02d027870ae0bdbed8b104a10605ae3939cfa8e7d4ae5e2f97b5958bed4a4430c01d04f980fac5e88de756ec949e14a35bfb3f32197c05b451", 0x74}, {&(0x7f00000009c0)="3d408cd47846fd99d1d1a4df38e0afdd03a817bf3b4673e575b2c253bae12d98c4d5e4e6d317ba457f2d0de6e1fbc5a43bae0d257cda31fb579139135de49db225bf75a3dea059b4a7a9808dd72eb1bd84d0cf9959907ad6b1e1ec718aa8d5004fd0acd19045d8d6e0f04b6b4497bb3126e4ad0d033ef175a58f55d0993d32bb3a10246c0e9ed8956592d6b51d4c1b3d35b68e6a354f5bdddcb0c943411abe361cd03acfa5d2f09a07700d9ce62314a233dc06de1a", 0xb5}, {&(0x7f0000000a80)="a840c8a67da22f1b2c4e068bb1ad9c499f093b4480b55eb7b9408f5400cc74932ab986ca937640a84378eb6446626516e84b0055936bb61fac109e2624e86903d729b0b10b4f16db7da1fa3aaa808fe333de0c9316c2412cb9ed2d604f8b3fa52416302221487c294ae9dc54783573eb5e7c1027fc39fa60c39afee14fb7cf3e6ef0041470dfd6a4a356a1d7e20a437bcadc7f0b5afa9f9d68bccd88dc02cc0150149950fdf196f5aa69b6c4d17ff0e4f1eb12c021fb1a6ff17ea6cd44b55cae0d9a054286ac6428d5a8d2ec34f045da5e7dbc1f8db2dcc83f53affd659e752b75f3bf443e576a5978614c0ed54741afa3ef7ac2b597143149c19c2fe9130a6f065fa277c2", 0x9c}, {&(0x7f0000000600)="c016c55101fc98bba00b0c2946a2b285871ce0494875c9d8979d34a99a409dcb328a6ff1e31414ec38af8d9348d49550faf55f18c1d9f281054ffbe9a13132e9a05e0542a376762a4d799b6b4f0311f62189f67e7708285a203492767e25e6bc4d28d6d3f8d9f50c2660483f8f942ecb733e84f8619101c2ec2ec357bec450d092e6068a319a9f761d766e6ae151f3f3cb790dda0a6dbc381be1a87e4d992bc55e39f166e65d1a5997bc4d255f00c45f6264f7b459ce6fc78a91f8935fa3aa5fe8be532e06387d82f07e", 0xca}, {&(0x7f0000000700)="f32ced1978f6103c6709573259e317066e84d42f18d090e52035bcf2ddcf8761f30c8179d42f2d06e49766e18561147a88e7ab4a817816b9da02e1744bc7eb653eb04ab70b5bf5111e01923c9bd0f4b72df99f19253083a444b5fbf214a2e9fbbc352a08731643692912aebd09546ccb28837254a30d1e53084dd7f6b7114fa3825fcbae9443ec15fb31bca97a87824d4bc8b632cf971bfb523a", 0x9a}], 0x6, &(0x7f0000000840)="a6d462c399e20d9d7ab19933a9b3d0e1d617be45eb50440e1e51f20cd773cd1b34e2669a511f6292d81a777376560dc1daae580d2419af271bdd485f32ddaa3679178bcbe6ff6f5d5d758535afbe2a930342eaa16108a32d9d31fbfe8bf4d89784440c3ff3fef2f998aebc9634", 0x6d}, 0x80) close(r5) recvmsg(r4, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x101d0}], 0x1, 0x0, 0xfffffffffffffe25}, 0x0) sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000000600)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x23c, 0x13, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_OBJ_USERDATA={0x4e, 0x8, "cc7bcce700116ac2ae434218d6d6f76d8f020ee10251322a2687b5988e023da99cf9aadc7e65db08816fc4b9810b2bff50c46e06d1827d0b08c8e1d05449b3bff40e32706c79e1a43570"}, @NFTA_OBJ_USERDATA={0x26, 0x8, "fe9b0c3b8bbfa879ced36c141f9e1ff9fda1035413ee351da8b9d0fe02f368053729"}, @NFTA_OBJ_USERDATA={0xd4, 0x8, "bd50fbc045da38f1f3370aff5eb2003235c726f048470c3ce3793535adca73403ee3f9d1e716ebbec342ad1915ef537880986309f7ec817a626a20d61248afe54bc0602882bda3d31848f7ad90dc001df7d8750d61e8cf6283462e69661a3183308b2f4fe5db6bb1cbfa931c893f84315f0620ce1512bc1d1b6b065a36d69aad47035570a39ff113482872d4dec3112f3483edff95a2fad821b647d83bf6adc5b1acf8d25d4cb2525678ff36f600d501880935da17ae4304e16dbb9f81e242bd564835f9b406a3ffc5844a595087ffb5"}, @NFTA_OBJ_USERDATA={0xa9, 0x8, "3bf954990a8fe7afffcd5dbba809acdc2ca3e9801c9c691cbee3bc2834f4cae281df53d29269aebd53e55f13c7eee013116a298a217c16fba3187f8c92f4992ebc4414636a54b122788bdfc477aab683fa9047eeb900c3f62810cd43eba756a61b890c912c68abf4542a06711aea69389224ab71c68cb318ad4c6d90b9fce9f499bd81bcc9e75ac137baecbe762682166dcabab6bc3c5c325ce185124e588e59d4cb86a524"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x23c}, 0x1, 0x0, 0x0, 0x4004044}, 0x4004818) socket$inet6_sctp(0xa, 0x1, 0x84) pipe(&(0x7f0000000100)) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c0000003ae16696cfcd61f38f00000304000000003f00000000000000", @ANYRES32=0x0, @ANYBLOB="a5fdad88000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r6, @ANYBLOB], 0x4c}}, 0x0) executing program 4: r0 = socket$kcm(0x10, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@ipv6_getaddrlabel={0x24, 0x4a, 0x1, 0x0, 0x0, {}, [@IFAL_LABEL={0x4}]}, 0x24}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f8480b0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=@newsa={0x10c, 0x10, 0x1, 0x0, 0x0, {{@in=@local, @in=@local}, {@in6=@private1, 0x0, 0x3c}, @in=@dev, {}, {0x0, 0x0, 0x0, 0x5}, {}, 0x0, 0x0, 0xa, 0x2}, [@coaddr={0x14, 0xe, @in6=@ipv4={'\x00', '\xff\xff', @loopback}}, @XFRMA_SET_MARK={0x8}]}, 0x10c}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x13, 0x4, &(0x7f0000000040)=ANY=[], 0x0, 0x800fc5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r2 = openat$cgroup_devices(r1, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x1) sendfile(r3, r2, &(0x7f00000003c0)=0x4000000001ff, 0x10000) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005d80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000000)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x88000, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'lo\x00', 0x1000}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000042e67ca8f39352320b318b0766fc6f9373230950f1d71b89d69c6ec4807fa578697a2fe29c36e3aec21422582697b5e8fd5d6046990852aaf668ce4331"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xa, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000095000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) writev(0xffffffffffffffff, &(0x7f00000002c0), 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000000)) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x100) r7 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r7, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x18}, 0x0) listen(r7, 0x2f3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x3a8, 0x0, 0xc8, 0x8, 0x180, 0x5803, 0x2d8, 0x2e8, 0x2e8, 0x2d8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @private1, [], [], 'pim6reg0\x00', 'wlan0\x00'}, 0x0, 0x118, 0x180, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@pkttype={{0x28}, {0x7, 0xddad}}, @common=@dst={{0x48}, {0x4}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x0, 0x0, 0x0, 'pptp\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x138, 0x158, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'dvmrp0\x00', 'batadv_slave_1\x00', 0x12, 0x3}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000002304e800000000000000ea850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r2) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)={0x14, r3, 0x1, 0x20}, 0x14}}, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f00000004c0)='svcrdma_decode_rseg\x00', r1, 0x0, 0x188158f2}, 0x18) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f00000001c0)='netlink_extack\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x1c, 0x3c, 0x107, 0xfffffffd, 0x0, {0x3, 0x7c}, [@nested={0x4, 0x7a}, @nested={0x4, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x488c0}, 0x24040880) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'ip6gre0\x00', r6, 0x0, 0x0, 0x0, 0x0, 0x0, @private0, @private0, 0x7800, 0x8, 0x7, 0x7}}) unshare(0x22020400) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) unshare(0x20400) (async, rerun: 32) close(r7) (async, rerun: 32) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@deltfilter={0x30, 0x2d, 0x1, 0x0, 0x0, {}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r1}, 0x10) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket(0x15, 0xf, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = syz_init_net_socket$x25(0x3, 0x5, 0x3) ioctl$SIOCX25SFACILITIES(r5, 0x89e3, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000880)=@nat={'nat\x00', 0x19, 0x2, 0x348, [0x20000280, 0x0, 0x0, 0x200002b0, 0x200002e0], 0x2, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="29000000000000000000000000000021000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000400000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000300000000000000ffff0000000000000000000000000000000062726983676530000000000000000000736974300000000000000000000000007465616d300000000000000000000000aaaaaaaaaaaa000000000000aaaaaaaaaabb0000000000000000d8010000d801000010020000636f6d6d656e7400000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073746174697374696300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff000000001b0000000000000000007465616d5f736c6176655f310000000069726c616e300000000000000000000069726c616e3000e575dd73000000000073797a6b616c6c6572300000000000000180c2000000000000000000f646793b7b3900000000000000007000000070000000a8000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff00000000"]}, 0x3c0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002c0001000000000000000000040100800c0000000000000000000000140001000100000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c226237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb64"], 0x114}], 0x1}, 0x0) r6 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000700), 0x4) bpf$ITER_CREATE(0x21, &(0x7f0000000840)={r6}, 0x8) syz_genetlink_get_family_id$ethtool(&(0x7f0000000800), r0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000600)={'syztnl2\x00', &(0x7f0000000980)={'gretap0\x00', 0x0, 0x7800, 0x8, 0x80000000, 0x6, {{0x1e, 0x4, 0x1, 0x0, 0x78, 0x65, 0x0, 0x7, 0x2f, 0x0, @rand_addr=0x64010102, @local, {[@noop, @timestamp={0x44, 0x1c, 0xf5, 0x0, 0xe, [0x2, 0x5, 0x5, 0x1a48, 0x5, 0x100]}, @ssrr={0x89, 0x2f, 0x70, [@private=0xa010102, @empty, @multicast1, @multicast1, @empty, @multicast2, @empty, @empty, @local, @broadcast, @multicast2]}, @rr={0x7, 0x17, 0xf4, [@empty, @multicast1, @empty, @broadcast, @remote]}]}}}}}) sendmsg$nl_route(r3, &(0x7f00000006c0)={&(0x7f0000000140), 0xc, &(0x7f0000000680)={&(0x7f0000000c00)=ANY=[@ANYBLOB="78001200060026bd70006f7256855c8f5405e164c0a06d1cebfddbdf250000516664cba3408179557096d7dbac0000a3237d426c1c7177ff4ba7558bc80aedd52b1126f4dcc26e8d97b003900119a31ea5a406789bf62b5d0db99ad1323bfb07519e1c657f32ca02000000a969cd959c7d511fceafdf538a3c353c3566740ac673b063c452981e97c0acd42f16f11d1d8266ed29681d3186685efd6c3471bd6f255d00d25e3daa2b11f52191d4d06d30d62139c957643eeff008bdad78908497997f03d501ec5a73cff4280ca7562d78ae07cc0da184003e0a8bfd0862b50eddcfad66e3d1769530e9e88352f6c6b34b61189250e52f4d23c5a375fdda88f9551a9199be42d6c46cfdb2390a47219a44d41c780b89d712d92feaeba1fe5e89b39cbcd97f05464cc4b092d433cea430ca589018404f33501029f5698ea27816df32f2910b018712e7218c71af2877", @ANYRES32=r7, @ANYBLOB="040000008000030058011680600001800c00090004000000010000000c000400010000000900000014000b008200000000000000070000000000000014000a000000120000000000b6040000000000000c00030007000000090000001000060001000000ff7f000004000000200001801000020000000000120700007f0000000c0004000700000007000000540001801000020000080000f3000000030100000c00090008000000010000000c00050005000000010000001000020009000000b1000000050000000c0009008d000000060000000c00070007000000050000008000018014000a00ffffff7f000000007f00000000000000100006000100000005000000ca0000001000060006000000020000000900000014000a000180000000000000000040cd0000000014000a0001f0ffff00000000f7000000000000000c000700900000000200000014000a00fcffffff000000001000000000000000"], 0x178}, 0x1, 0x0, 0x0, 0x4002}, 0x48040) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4, 0x70bd2c}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r10) r11 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r10) sendmsg$NL802154_CMD_NEW_INTERFACE(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000a40)=ANY=[@ANYBLOB="1400000098df58ba77d3907c3e73fe63fda51c1577f2a2c288aaea9f74b4de7ec7a1f23da382558532c2bae7a320e3ee0294cc568fb8ddd400326223af2d170f628728304f4b58a208cd6f73eb0e9629460511868bc85ad95c5f5b11708c46b0db67868d08d1c323d761de43e914b0dace8626121650dd5d96a12287902009b9865f27f866c4eaf156d0bb6e34d0afacfa668c3d0ba3aab49d718dbcf79ffe44f59c2012e0fa73aa6253b90feb614c9e243012afed445a9611295cbd47e615ce67", @ANYRES16=r11, @ANYBLOB="010000000000000000001c000000"], 0x14}}, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="554b0000000000000000080001800600010000"], 0x28}}, 0x0) r12 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x14, 0x30, 0x53b, 0x70bd2a, 0x0, {0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$ipvs(0x0, r12) sendmsg$IPVS_CMD_GET_INFO(r13, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="010029bd7000fcdbdf250f000000080004000100008008000400530d0000"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4010) sendmsg$IPVS_CMD_SET_CONFIG(r8, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000900)=ANY=[@ANYRESDEC=0x0, @ANYRES64=r13, @ANYBLOB="020035040000fbdbdf250c00000008000600080000000c000180060004004e2400000800060008000000"], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x40) executing program 1: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f0000000b00)="9e17c2977a7873aee9") bpf$PROG_LOAD(0x5, &(0x7f0000001680)={0x1, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="b7000000f8000000bfa300000000000007030000f0ffffff620af0fff8ffffff71a4f0ff000000002d0a0200000000001d400200000000004704000001ed00007b030000000000001d440000000000007a0a00fe00ffffffc3030000e10000009f040000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d66a77ac8daab82167606068067500c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923030000000000000014e72ba7a54f0c33d39000d06a59ff616236fd9aa5b4e377184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049ef6a989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7592566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270fa3d0ee281eaa11ad47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42e54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65807ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91c11ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6cb5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cdb70f617af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028af0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00672f0814bf895e3a6dfbc711243f58a817895f5c4eaf7de8411a831ef65508f416ae3fd1db8386f6aae40515273adcff6196bb45476ec0a5279ed223f772aee25947b1f0d275c0e495b050f10a0b5d19b578a2b4096b9df527211bb39a29224c34a517dc344a195697b0c158d3519c04fe7621ebeef0bc369a1431a90c4117bdfe358e0e869e9f3e5443813261c1c3c78ab2584603e4468de7d0dc93691491050666f4ea5f083a1b281ed230569921856befe07538fbf33f43fa4ad583867bee301ae1e2566ae7a7afb7fc54895a2fef928d91a162affb4d373c7628a2871d7d19eaf06ed5f58f799c8ff391d3752b115073702ee257ade173dd2f736ed5939f219ba42f7650b9a262f6ee4af52aba3e669a835555ea1674f89d7f98ee1a1c7f977e0a93fdf91606d01c1a9dacfd4328502948bed0bc9514e4f66846bc1f245aa5abad88d56679092fee01007cade7ee72a49a498d51a26ba5cf0896cd9143d457262976f682bf31833ee99b5301f349dd2815e76a8b9a6cec5e000bd6bdafcb9536379b6cd0351cfe345abb1f1bce4d15a3f8b2bb447249a6cc5d201a"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000200), 0x8, 0x10, &(0x7f0000000000)={0x2, 0x40000, 0x1, 0xe}, 0xffffffffffffff7d, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2, @void, @value}, 0x15) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000180)=0x2, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x200, @private2, 0x5}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x9, &(0x7f0000001a00)=0x1, 0x4) sendto$inet6(r1, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) r2 = socket$inet(0x2, 0xa, 0xa22) setsockopt$inet_mreqn(r2, 0x0, 0x23, 0x0, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0xffffffc1) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = socket$unix(0x1, 0xfd407b1c7cc76f1b, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x400448de, &(0x7f00000000c0)={0x4, 0x8000, "e30022"}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000040)="05000000010000", 0x7) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r6 = epoll_create(0x800) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r3, &(0x7f00000001c0)={0x10}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000140)='contention_end\x00', r3, 0x0, 0x4}, 0x18) close(r4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='contention_end\x00', r1}, 0x10) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) getsockopt$inet6_tcp_buf(r3, 0x6, 0x1a, 0x0, &(0x7f00000001c0)) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001480)={0x14e8, 0x2b, 0x1, 0x0, 0x0, "", [@nested={0x14d8, 0x4, 0x0, 0x1, [@nested={0x13e0, 0x128, 0x0, 0x1, [@nested={0x1c8, 0x16, 0x0, 0x1, [@generic="a853c9b8abcaf8170bdb47e4629fc3268596303ed2c6b8296f239889391b18dfdcfca64bd04a34bb0a63a7042959100da17c2ccd422cab9f593dc6159a179957783ec1a03e590d77a949200970f35372cd9648314a4938a89e06afe7235c4d166686db14ebf9779c16a76a42f9ec292df0d99c0734f843551096e3b1f73b52b82e9990c312777186ba52af78f4cbfdce6d17224aa8f79ea52af292e4c2a495a24b5cbaaed76c978e67174e3f6f30587fb88bd0bf", @nested={0x4, 0x5c}, @nested={0x4, 0xad}, @generic="265a0a4b0285246634b2d158744a61fad62b3221c539dce88c5260d51237ffe80a67bdd5d070234c1a736e4994fafcfd77a0b89e4edbfc23060ad4a2aae01cf8e5076d5f48ccd6879166dfc05a95308898ca3512b2f94634454bf6a9ea79da9541484df8a2e7c2fffa5fbe095cc4ae6f2a4c1c2fba2368afb1f1187662bec18722d278dac036fe8e197c1a2d8b81f9060831fa1241cd895d88509d31c02443a4b9bf891d9915e552d49343974a97a411650f360399eac84df45a177b0e920fa6e75cbf14d7cf2161c1984361157cb0161cfe6330b34fcbff92adb1d574ed75349338175f62eadd68da3b41a27d37e509", @nested={0x4, 0x23}, @typed={0x8, 0xd7, 0x0, 0x0, @pid=r2}, @nested={0x4, 0x80}, @nested={0x4, 0x30}, @nested={0x4, 0x3c}]}, @nested={0x5c, 0xa1, 0x0, 0x1, [@nested={0x4, 0x147}, @nested={0x4, 0x26}, @typed={0xd, 0xeb, 0x0, 0x0, @binary="03957bb9c8d9de7a49"}, @nested={0x4, 0x5d}, @typed={0x13, 0x29, 0x0, 0x0, @str='contention_end\x00'}, @typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @typed={0xc, 0xa7, 0x0, 0x0, @u64=0x5}, @nested={0x4, 0xd8}, @nested={0x4, 0x12b}]}, @nested={0x53, 0x23, 0x0, 0x1, [@generic="2c26403fd5fed6780d7a6f39428c821feda3698ecbf979e49a14383b4cb7855c11d281", @nested={0x4, 0x136}, @nested={0x4, 0x137}, @typed={0xe, 0xcc, 0x0, 0x0, @str='syzkaller\x00'}, @typed={0x4, 0xf5}, @typed={0x8, 0x131, 0x0, 0x0, @pid}, @typed={0x8, 0x4b, 0x0, 0x0, @u32=0x2}]}, @generic="5007e2d17299b2339b67c16a31004deeab47d6790110f3bca701eeaec10afcf586ab5883fe01a9973bf18fe8dc8edb10dd625479455bb903e032262bd1cefb99bc7d476d240bb2e7d78aaa4f0948977b4e43e41ab037c2997a00742f67f2e28aa5f87c63fe40698988b4e59b0c5bab3a", @generic, @generic="3f6e86e5e08f4599fa6bedbeec4a3ea26bd69816dee6100a171403ab4ff8b9199535d50727f78966ce0e7b25f5d563a00dc602412265d66c0cdcc800ca910bc738b220c9aa6a230d9c81b1d196e169482cb7f5e95b8d5fe523014a08de71dcd22b07667e9b08e78cd6fd226b26ce3721fe480f27fbe3430c6d9abfe0f4dad6999d2a6d5eb91f004fbedd730b1d397afaee", @generic="feca4d8690c2491a0c086f25f27a2bce0cc898f4de62f28269b45923edb4fb9b91bc6978d29af2b0434766d348b00f620f69761b5071760d4df6cb0ef62c4e46216cd48fadfd5592091c313ffe602a8122d7a50946ee2b6d3aa90be7b95d52", @typed={0x4, 0xd1}, @generic="309f64e5392584b66624919d4f257a3e4865f6e3597a3abb2a59ad497cd17add4b84d4ab3d611216ee267385be0f179d8e597f7edb3df214ef238cf3e28d665258d4259736553927bd642e918c1e9850503a08ca4cec42aef309921c7893e4ebe1f041b427472e70481d47daa8a315e1edd54a730ef6eac6d5b499309ae3e2245f362ffb91c9ab91629e7973d51500433e2f71e95c7e0e453e62cc4626897607a768dfbcc1f2b95e37ca5ba76a10549b7136891967336cc2565a005167151d312ec7b515c27efb946f7d82a6633e8ff321bcaa1ba952770d94b74faaa7511714bb504d9700fd0538637bb5e4739ac8ecec54d7f3f8f13601e73cb9fea4615e4025b331b4079d3f6480c35df1f2db641c060c2e3ff61787d92fac7f4aa13058a1691a33f17c16f882294f655f31535c252d54cc6c278ca5f6319e5e351e38108ccdf54b620980356e77ee64f67d6b424cee642fd0d2db34d8cfc7f66d00120379e095d303363aab2ef831acfdf211a9c3d2f2fa59c82bf37d690137dd0f7daa3cd8763b18828a1cdf9b3955a7f79d25048935a33bd75aca76236d65b226f5dfabae613d0e6a0e50a527a7abf8fd1c73d295064e03bd0bfa97d0139d87aed18ef0a359c260168a9f93908d7cff99763c181571d423b0815ff06f46171fd1d09c4813210b69f91d5d95470fb13dba7bb116de09d7de594a181240d2a1a85e9f68d4b48549b555eb739fb5405fa7b29ffcf0fd8e2b034ef94d82ace797a6a2023e73857c287fb16d24d4cffbbb7677ef76790e3daae1eed2a8029e5b8f63c05bd57efdd35e135b52f9e09f3c85179270af01b2840762f5157dfacabf4904690a8a73ec524968f657919bfd606545927a514cded6792c7e71f6d688a67b28cf6deff447a69e38bbda42e1a4dc86f5ec271b399558f51756749f0b03282c38355ef07dd9afcdda91118287da51fff2d0be462fe5b62c8afbadbc43aeb9c3238be20754c2d7ba754aeb7c43b517ee452bc3b27bc5edccd157005075472abe17e27c9b9b4e446d65ec5b12c28ee9b9ec35d114da78850a68e807629bf71355d8c73183587ebdc598d013a94fdd9c790cb8b33ada0a3e9eb0e9c2adc9fab692c7bccfd12ab8b3a4ed824a8ebdff2e8efae531f55f2f3098d2d1297bb98c1fa562c88e0332c95bd5aadef40b0b7e533f02fd8848c2d2d4c656049153e01d593b2978f1b1d4b5e4380e00357afebe28b13cdfcd26907f1a913f807e31c1487dab0675ea1cba6612c8f64276f31f25ed06ac7c2b931c481412c5c460d1737f0212a52efcb3e82ee1baff978ce217f9671faaa478aadee10880a0b5c6ea514fd0beff04d33727c5b8ba62c5a6dcb5745ab6b63534a5d947bd3083a13e69e645ecf5fdc3d6008bf201064e5c73e0ebae9dd2b5b4078125d0f28044c0b7d1362ff49be0e2147cc23cb694757638ac8943a20b53f43a03185eccc083a4cbaa79627a2428dd46a3dd33cd9fb53a89553e5777b52c3ef8e8e69c8cd6546fe23afd03164d5fcb827a09813b9991ef2fbec2c83d5d5fde79a5e23ba03a2ff4f6064bde20fc9da1665cfd471b8a1c41783109217c01eec975e1af63e0e887084db726e556ce533e1d41ac0da89943ada45301bc03f422f5ec632af810f3b7c8eb79927ab551c70851aa90efa6276d17be4071b0051aa516ddfe666c3644b0151487add6436b88b52eeb97302b7176f74661e7b2b416517a552016fd3ee538d4bb7d645cf08386242429ec7fe5f5eb5ee31f0dc3cbe2e125de0f96e3e8185cc3fb7ee314dbd50713a4855ad49ecc1255423fac872fe66c9f2943627969419022337c5b4307c69635fb8fc5ef19420b6f210f609150bf4feb90c269cbff9ff6b68afe9d69158e97a8d994372a09f2c2b081a4c9e7bd038231df5df38f8ca3819852cbb5d51e16249061d1239f01390b429d46e3e8582cb450db40673ce6cc73deef412bc0b444bdbd9a9f996208ce6ad1960bb7547451b485347d71dca57a6b6c285edf206266bcb1f91e2d86cdbbd2abd3f7f7e6b9b74f4f50137d65b6fd2bfe6b9f5dcbeb2f9396c8b2b34aa54544e58f1345d5877f4b56dbbe6bb1c26bf1f42908aa655dbb8c3c97108629c53428afc8dba252639cffb1b841720192aaba4b2f579f10d57110ded8c63e779ee8afe8a612774a3385797fbe836762553e81d840938e7d462feb40d750081a33cb0636fee9f1b6fabdfbcbdbd4d6831f9de349d807544d864e8225eb1bb56ad14efb699676ad3a3bca439f29fe6529ab4eb27a81b7d4be829de597aea299aa23011aba45dc0e57e1710a5f947a30f06085ddd6ed17a95d0c800afbf4b97334db9b06fc342e99a375e082b6a5803c26385d3d4c0c940ecea2d41c36ff3efeac76366a9a2aea261d7dc1443556db5acec0fdafc9b11fd518e25759b5ab4e5b99efd23fa43075c0daccd9f80878771694322c4d929db6f99ca4dbbe699887cb134b051896472ac4ad5980b078a0c108971d7cfc13295a5557a42aa5515c4931192800c2788ca107a42a7b87eedd3e3374bb4ffdc46f53e9bab6bb3ba76b55b392d4cb36c83a2845439398a94160ed4d47006ca0c2b36345e13980e220f5c854bb780bfbc768e6ca202f6873613581ff9e832e12f6e7798a880f42dee72583d303f6bda3f4b92e3f03a5ef3c0eda101b02ebb3244d36a01f151e78a705ee5a694a336bf4ffe54da9fa1d5c6c9abe5d8473d3d25191fbd197ae310d895b4addab4518fb0dbff1d67bcbd12505fc93f3cd8a50f8cfbc66e0c04433a252a6077a7a5b07cc3f4d0f95082e4597a834f6138a416563b02ee55b35751e8a9792a811d91e639dfee39d540b6ded5960f3e70964718db77240f4274a26131632aa97cd48d652f028d00a21400f0ff37af664d9aee71654ff2d17ea6cf2d3bd124fa09189d9b900358dd8b529713a02121666d60776fec6c05fd0e48da3ff20d44151e717137b281b689d56b5a97e38329a6267c9e76632572a1e08f7a09140474c2873f99e863316b8095fc4be0e88c29d6b8ce628417796e48748ab8632902f135ee32b4fcef1ea223628561ad31a4482dac5dd89e716b5cd06399a2f48a08158b673c855c2cf3be808a80cd27975adb25aaf065793ca758f77c595fe69b7bcb39e2d9df18c6bb215997438a2b63e01e720386bdbe0e5a22c64b8f314ae4f929dee694765dd6c60e55c7fffab55a1403d13e437127ba1e90b78ac22ae410a8f6031e5b6daa8f7529c2b1b44c8e8584c8885f19c09d302b9d9efe039236768a92544c0729eb955f82fa3d8c539cccbc68ac6b725bb060792d344d151ce4cf96caa9e32e9537b175c088a9592e724af9975035a7e3490783b44c3f3ae59d423898fe39380f1e729abe3cc25ac211c182e248b5ce8b4ed83f8860cf31a7b7a49302df21e1fbbf47840d10ccd8b3f1edcd29001ac2a2bbb6fb39e857c098f9ab63a394a2f815694e2de1eb3d159c998bc02b6dab5114c83d4c5236293311c15585cd2362db3fc1437be2fbdb7c83aeda6c597c4ba2f88a5b0b8e9b5b88a561a5d43f0418a829e47d5e488790db211701bea51fb72dc1b372efe5cb7f42d31b8dffc8b1abe2a500e8960dbe1f477f4d347062253ff7007d278b4b87deb5f786a3bfe5303004da3d5124fc96ff70e7eba109d9f39ce01d8026a84de8bd94de4c3645e6e9ca0d5895804eb30274f3f3e27adec53b403a3770aed58512fd4bca5fd565a30434b30d124b84846650303be4d4e19ee68927b9746e756c3ce381880df2e68cfb51435a2b52311d03b3564547d8c609604fa941d81b5d711b699718a5ff31e247718c0a653d7d751f53b2687c8cd509da11316e789eb0dfc26ab72eb0adf082a2ad354987f9a8ccf8326513fa5d8f5c85e1d56f474ab1b4677693dfbcb1dba247bef09fe7a8fd3ef110cd35e705fe01eb51f1369b5fca2ebc2133dfbb1f273a1c4c3c89fea73170604c3c6a7a66692563b2116bd1a8418d8a076f2e1ab90fba450f1f0fc72858d4d2db58e16b66b221e8c6fdb2e89783fb382620cbdce4dad8b098134de456250e15d8a84a38504a17252d4b3512a420f63dc4afd8149b70d1e386add4c6e5d8a836c749da4fe4adfdf22df5503d3de9237269f276a27f7745daedb3134ed3e16fa9b9472e54ca5b82f87dad03ba947f655a28d04b14ee937ffc9ed4d1035debe61a64881953af868217ef54d501e8f1c9a44a495faaa525c34312205fe1034cfd921d3cc8e03390394861288421b772198c29da2cb88d505e8e67dd94b6db57c271402a95bd89dadbbd1a51ac46d2e2e586c1b9c6e14ab982a4d3676a84c931a56bc1cddd5b8b3a84d56d6104c73b097799a35e0dcff0338c984ee1d2bf5d9b3d68f69b1e0877128bf5f807a96ad2b6e4306b80ca873fa5c64a80e0d22046e01b8c135737dd8b99ea8fee69c6b0d43be07d58bbb3d838290bc317c24c2da8b1df157543ed1c84fd9611ea972afc42315076fcced07e0fc9ee2df70832a1522a8012f351ee17ac597ad2bb0b4339f711da2d3e9783549ab1455cf5c64294094771ea4e1cc2c5e3a3deb026c6458fe8d2fed3663ee7fec9529ac6caec6720866d5829e4762e348c440c5c7acb94be667f79e123a53acbc6c09b8a8bcb43d652d485cce26f22058e96c0ae27b9b5a0044c633c1868d094ff6c124d4914b6e9c457f249493a3643b65493a3e641eff935a9040012f07e7b4c1ded220ab6e8fe7007f1aa0ec7585b4f4cb96e6dbe392d611202a40cd647cfe4195a3af687ef525801b804fd9167d0753181184bc78c31ea659c4ccfe31256f4c5a636cc68587df244ac3cb9b3261a315d8cbdd473a3f46f263be684a35e962c4f42a530fa6e435517043bdfde2a373031b2a51bb9f0ca354d62b643bf2ec2f2850a12e5f8ef996ef527a2c588dfe3aea1d672983ad8e6c50f75368a26215e36c597555dfb9d3b588109c62d307ecc9cb744c8bc1b19a509b9efc21c5b28adabd21efa1f8e0a789fc629332841fa052759b909378f85d855c82eaead3d8400a8fe835f7308bd038bea66d7b431cc801b818401a21e169fdb8e0c4c8298d4eb7989a7a5c43632f346333b114cebd0b21b85564e5a9ed8a07089841b742b7fe5abaddb114bf2650475338342de9283d19abfd6649ca2dec2354d9879ceb472b29a07e6648fa64c45739fd15e0a9d4e9d91899b1397c13f938769de4f9ab773164dcde5dbafb723018fac9f3271a2abd5a8a8453aacda5530fa39477fbcaa6569dcf67c3385fdda37aa40d9761d8b9cba5cdd04f87cbcb9c3c54f62705e8951080caa74ee44d4588198a424fa7a7742b64bdce771fc88f7df6cb9080694fdbe8e867ae54bc0fecc7bdf99dcd313fa72d4f726a4d9f552c7f18a69f367dabba684b66ca6aecf7a238f1fc7a27ccb6ff377b477aeaa25c888a5d68acddd06ac2085d2b6484eee193ead0d33a7e0c2b0cd612f85d6226168e49972c0146eb677b7a772a71fd2199e653b850646768a96210e7c6c4c02daf1a27950d86fababbf27834dbd0d1f89438c932a3786d1a3f50839072dbbccb66f9f81ee77aff44e89189abb7ebba5ca80cfaf9b8903ed06e302b263073c4389e8d4841382409c08c9628fef02d33bb28c3cbd42a24e3501147aeaab6e0eb80b123fc4ad468d99692fd2817ff303d160d53aac18718c2c3384a3925599684951e8c8c7b7d48aa99dd90d6ef59e72287c6acc4ce670e4e7d4bf24eeb0391000f5b1b8f1c93250109242cd655a01398ad2e4e"]}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@loopback}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8cd1"]}]}, 0x14e8}], 0x1, 0x0, 0x0, 0x11}, 0x0) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) accept$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x3c, r3, 0x1, 0x0, 0x0, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400d5}, 0x0) close(0xffffffffffffffff) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r1, &(0x7f0000004b80)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="82", 0x1}, {&(0x7f00000000c0)="8484", 0x2}], 0x2}}], 0x1, 0x4400c800) sendto$inet6(r1, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102000000000000000000000000ebf5622b060676179bf02a5ca21c9181166a3e561614e54b27d2d16a66c28a808c576265bf5f436e151a08954809c2722084ed8ecfed53615b50bdf78b4a1f5f030efadd9729a5e08439786be6f3ab759e1813b9e146f3a092a05cce"], 0x14}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001640)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x4}}, 0x9c}}, 0x0) recvmmsg(r0, &(0x7f000000c2c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x3a, 0x9, 0x0, 0x0, {0x1}, [@nested={0xc, 0xe0, 0x0, 0x1, [@typed={0x8, 0x5, 0x0, 0x0, @u32=0xf}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0xb0, 0x0, 0x0, @str='!\x00'}]}, @typed={0x8, 0x2, 0x0, 0x0, @ipv4=@broadcast}]}, 0x34}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x23b, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000001200)=[@in6={0xa, 0x4e22, 0x8, @loopback, 0x6}]}, &(0x7f00000011c0)=0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x40, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x93}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x40}}, 0x0) getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000000080)=""/4076, &(0x7f0000000040)=0xfec) socket$key(0xf, 0x3, 0x2) executing program 0: r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x1, 0x0, @void, @value, @void, @value}, 0x50) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r1, &(0x7f00000011c0)="a0", 0x1, 0x4495, &(0x7f00000012c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) shutdown(r1, 0x1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="00000000000000000094000000000000000000000000005fc273680000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x100000, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socket(0x10, 0x80002, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MAX_AGE={0x8, 0x31}]}}}]}, 0x3c}, 0x1, 0xba01}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000007c0), 0xffffffffffffffff) unshare(0x2040400) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000020000000000000000000000850000000f000000850000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r5 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000100100000c000000fa000000000000ff"], 0x18}, 0x40) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f00000001c0)='netfs_rreq_ref\x00', r4}, 0x18) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={r6, 0x0, 0x0}, 0x10) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010027bd7000fcdbdf250f000000063e4961f47cc83e3f3b310000da9d68145b18b8eb452fbd"], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x810) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x2}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) r10 = socket(0x10, 0x3, 0x0) sendmmsg(r10, &(0x7f0000000000), 0x400000000000235, 0x0) executing program 1: socket$inet_smc(0x2b, 0x1, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@multicast, @random="777de85bf4dd", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x8, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_rs}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0xa}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x80, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100e}, @CTA_SEQ_ADJ_REPLY={0x14, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0xe6ba7615268e7f7}]}]}, 0x80}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000300000000000000000100736974001400028008000200ac1e010106000d00ff030000"], 0x40}, 0x1, 0xba01}, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_REMOVE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xac, r3, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xad}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xe0}, @MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x4}, 0x40000) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x1, 0x4, 0x6, 0x3, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\v\x00'/20, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000008c0), &(0x7f0000000b80), 0x2000005, r2}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000340)={r0, &(0x7f0000000640)="87aa0abecf670dceba8f350bf354a5e0dc3faed171d650d741014e148c5b232b6e1b0a6cb160fd117e77447c6de84edd4ef9e41d73cb1ece6b51cb5a6381f90383a1a778718f551a88a06bb3cc44ddf3e081243a0fb4a4696ae33bc125b05f20b4154cf5f9a52d87d4e5dc09d42c2aad5b30703f02e636f48b70d0b2046d64ae5e3a56e7dd95186f098e233dae9c6acc796677d1b4622d6fe67176b654b5ec5e905f50fc31bf0b051dfb7a26a93fa4172112cf67398c0de89d03b804f0adc5a51cd3ef7defa1c197844981daad026a9840606884252ab4105b31ac1f893cfafc1fea6cdcc1848fdd5e8b57d367", &(0x7f0000000740)=""/156}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000a80)=ANY=[@ANYBLOB="1800000000000000000000001000000018150000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005500000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x30e8, 0x3, 0xfffffff9, 0x4080, r3, 0x7, '\x00', r4, 0xffffffffffffffff, 0x1, 0x0, 0x1, 0xd, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000000), 0xcff5, r5}, 0x38) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r6, 0x84, 0x74, &(0x7f00000000c0)={r7, 0x0, 0x10, 0x6, 0xb1aa}, &(0x7f0000000040)=0x18) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000240)={0x0, &(0x7f0000000040)=""/141, &(0x7f0000000500), &(0x7f0000000280), 0x4, r5}, 0x38) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x74, r10, 0x0, 0x11203}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x5, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x10) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x8001, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socket$nl_xfrm(0x10, 0x3, 0x6) r11 = socket$rds(0x15, 0x5, 0x0) bind$rds(r11, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r11, &(0x7f0000001e40)={&(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@rdma_args={0x48, 0x114, 0x1, {{}, {&(0x7f00000014c0)=""/54, 0x36}, &(0x7f0000001540)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1}}, @rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f0000001a00)=[{&(0x7f0000001680)=""/82, 0x52}], 0x1}}], 0x90}, 0x0) r12 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r12, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r12, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r12, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000140)="03", 0x1}], 0x1}}], 0x1, 0x34000811) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r12, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYRES16, @ANYRES32=r12], 0x1000f) executing program 2: r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000580)="fc457c43aa3f7d64673331496d0983b8be420782d9ac4b57e91f62b9dda712d2ef95adf34bc11e0e33b7a5c2842e81cb", 0x30}], 0x1}}, {{&(0x7f0000000780)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10, 0x0, 0x0, &(0x7f0000000840)=ANY=[], 0x18}}], 0x2, 0x0) executing program 3: r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000800)={0x100, r0, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 32) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000020000000000000001000013070000000000000100"/50], 0x0, 0x32, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) (rerun: 32) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) (async, rerun: 32) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffd51, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async, rerun: 32) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) write$cgroup_int(r5, &(0x7f0000000080)=0x8, 0x12) (async, rerun: 64) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="b800000019000100000000000000000000000000000000000000000000000000e000000100000000000000000000000000000081000000000200000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000001"], 0xb8}}, 0x0) (async, rerun: 64) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) sendto(r1, &(0x7f0000000700)="9ab5808857d89c02fb45b512a3e405c6a18df8d13e5cf79d358fffe8a74dfd3756756c4fe8b50d3d96d0f9fa2059f757f3fb9090e0baec4219f1e878f050ffea02cb5f22934621245b9c587a8fe9ae5621d69347763fd81fafa83effdfb5b20c837d4f43ee97ed4ad995b2c03a90e528cc72156df5b7011d5dc7eb9b7cb3572510eb2fce21f1afc000da068a1f27ef4f8667bb6feae9fa6d5c59f3640c51385d818a97c6dce72528a17c83920d3d5a194d8c055e5622100819b50fe0740c2cbbd77139520f776b561443685167d9ca17c0514fdec1df9d5b9708c6db71c861f9fbe708c3946118c89794ffa11aff077ec950d7", 0xf3, 0x804, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000002c0)=0x6003, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080)=[@window, @mss, @sack_perm, @window, @sack_perm, @timestamp, @timestamp, @timestamp], 0x8) (async) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) (async) r6 = socket$inet(0x2, 0x2, 0x1) (async) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r7, &(0x7f0000000100)={0x18, 0x0, {0x2, @local, 'wg0\x00'}}, 0x1e) sendmsg(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)="5500000018007f5f00fe01b2a4a2809302060000ff41fd01040400000a0012000200", 0x22}, {0x0}], 0x2, 0x0, 0x0, 0x7a000000}, 0x0) (async) r8 = socket$kcm(0x21, 0x2, 0x2) (async) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000940)={0x0, 0xe, &(0x7f0000000000)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe55a10a0015400100142603600e1208000b0000000401a80016000800014009001100036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) sendmsg$kcm(r8, &(0x7f0000000080)={&(0x7f0000000000)=@generic={0x25, "4bc475336c5858aa36d22e2605dd52416ad64dea6679d6760eb3ae06eeecab8fb38f5dba7f566ef424bcfc034322e5179b4783cd9ede9144e15085deeab643ea8a8f0048f0be4c32ec727eba69e206dbe9dea8b7cf46938ee7feab499bd8db55f5c530e2d55a128d603119be1625aca347038b73ee81502998f370791659"}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYRES16=r4], 0x18}, 0x8000000) (async, rerun: 32) close(r8) (async, rerun: 32) sendmsg$inet(r6, &(0x7f0000000600)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000002100)="0800a9fc0da6b30a", 0x8}], 0x1, &(0x7f0000001d00)=ANY=[@ANYBLOB="18000000000000000000000002"], 0x30}, 0x0) (async) sendmmsg$inet(r1, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000200)="27fe6da9b9cebbb18bafd9ccd79f0efca7a903c7a6fb41ecbd409f1a3db49cc612de34d4e9a8af95005aee32dbf7b63362533b67d254932beb05349e93971a53b856ce30901dc6d5679605b1dfde5241ca7183a9232bcb8c29e4fa570f53f09a5c34fd7e046ae08a1231a6f5654f2a870ccb697f41bf7a60a68033e80ed7dc6c7c06deecaaf2fbbd4e2bea22582fa90d8d14aa07b40e9c3415afb5", 0x9b}, {&(0x7f0000000100)="ac04048ea155344276", 0x9}, {&(0x7f0000000140)="a3dab3a1efd701da2d9607fa7ae104fe4e788344012ee808a9760da3249ac6", 0x1f}, {&(0x7f0000000300)="f1374fb8259ce1fcd099ef0a9ce716aa1c8be4e98a99f15b8069b924e58f605e96f1e947ecab1f70a511d0868f949bd4f8efe41209d6e6ae2413862ce802da43f9f1520ebded89d4947eb2685f780aa5db2a3728c288", 0x56}, {&(0x7f0000000380)="a58df42e976cc6e43303b58c453196fd57f61c89e96c0ac0ad0c4c19a1b80b2e78bf8fc8a904310f90732a6c316473c27706680d7dbadd7fbeb2a98436b22b99174eb9a36e84e56ddfa1e59ca6b03bcc32c508715075ed74ed334214928bac4f19ffe2a8f6bdef50f19499bd2b31f380b7948507479bd6170e98c4106a5c0edf30fa5e08fdfdb9571231fd07a95edf125df4433624b9e2df35f8d92ceb09a9fbf78fa03e044a99a8c9f4e524cd1ac5148a20575ba9f60acc4459ae3b5d84366dee82a25d7884711d9f7586cafb21b4ac5ce5eb48e31d352deb0e5474dc11", 0xde}, {&(0x7f0000000480)="bfdf8f623b14d1b0d12a6c9decb13220b9ee0af979d90e2ef5aa0ebcbc792d3411da", 0x22}], 0x6}}], 0x1, 0x4008095) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006b00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000200), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x5, 0x413, 0x0, {}, {}, {0x0, 0x0, 0x1}, 0x1, @can={{}, 0x7, 0x7, 0x0, 0x0, "94b1c39a3cc2fbfd"}}, 0x48}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x24, 0x3c, 0x9, 0x0, 0x0, {0x2}, [@typed={0x4, 0x200}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x3, 0x0, 0x0, @uid}]}]}, 0x24}}, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2a, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @val, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x60}}, 0x0) (async) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2a, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @val, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x60}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000000)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="cf0400000000000000001300000008000300", @ANYRES32=r6, @ANYBLOB="0500130092848b000a00060008021100000100000600100080050000060012"], 0x40}, 0x1, 0x0, 0x0, 0xc0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r8, 0x5, 0x3, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0xb4) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000001c40)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2ed0300000000000000af99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14008c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000006da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c4159b364a4fd7013f34db173a4fdacf15229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4978ea8e4aa37014191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be867a28f09c5877fc2355ecdc9c30dcb2d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff3a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb357b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50265a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d9a0e06da200481cde8bf475bc3e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a00"/3590], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x2e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (async) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r11, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000380)=r10}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x8}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r12}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x3a}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) socket$alg(0x26, 0x5, 0x0) (async) r13 = socket$alg(0x26, 0x5, 0x0) bind$alg(r13, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-ssse3\x00'}, 0x58) r14 = accept4(r13, 0x0, 0x0, 0x0) sendmsg$unix(r14, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)="1709f53e25f27116776b40cd3c550d298dd1b9266c15c25b83f011b965bb18efe36db9195a46d7dd34", 0x29}, {&(0x7f0000000240)="8bd751665b27b5ee408c629bceca8e7af4e15e0c93db7c7cf5b0d8bdaf6d95e8f449260f9dd2f4b86bca6d5bc7951cb16b4c5e340be7b089af5481907baf4c757bc0ff04cea7", 0x46}], 0x2}, 0x0) (async) sendmsg$unix(r14, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)="1709f53e25f27116776b40cd3c550d298dd1b9266c15c25b83f011b965bb18efe36db9195a46d7dd34", 0x29}, {&(0x7f0000000240)="8bd751665b27b5ee408c629bceca8e7af4e15e0c93db7c7cf5b0d8bdaf6d95e8f449260f9dd2f4b86bca6d5bc7951cb16b4c5e340be7b089af5481907baf4c757bc0ff04cea7", 0x46}], 0x2}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r9}, 0xa) r15 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r15, 0x8916, &(0x7f0000000200)={'veth1_to_batadv\x00', {0x2, 0x4e21, @broadcast}}) r16 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r16, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r16, &(0x7f0000000340)="24000000010001", 0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7a}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) executing program 3: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0xc, @broadcast, 'veth1_to_team\x00'}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x101a40, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f00000000c0)=0x1) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x2) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000000100)) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0xfec2, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6gre0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc890}, 0x20000000) socket$pppoe(0x18, 0x1, 0x0) (async) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0xc, @broadcast, 'veth1_to_team\x00'}}, 0x1e) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x101a40, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0) (async) socket$pppoe(0x18, 0x1, 0x0) (async) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f00000000c0)=0x1) (async) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x2) (async) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000000100)) (async) socket$nl_rdma(0x10, 0x3, 0x14) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0xfec2, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6gre0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc890}, 0x20000000) (async) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newlink={0x48, 0x10, 0x439, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2404}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}]}, 0x48}}, 0x4050) socket$inet6(0xa, 0x3, 0xffffffff) executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x4ca31, 0xffffffffffffffff, 0x0) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2711, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtaction={0x64, 0x30, 0x9, 0x0, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x1, 0x10000, 0x10000000, 0x1, 0x5}, 0x4}}]}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x64}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'syztnl0\x00', 0x0, 0x29, 0xfa, 0xfd, 0xfffffffc, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, 0x7800, 0x80, 0x4b0c, 0x3ba}}) sendmsg$nl_route(r2, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40020000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@bridge_getlink={0x34, 0x12, 0x20, 0x70bd27, 0x25dfdbfc, {0x7, 0x0, 0x0, r3, 0x20831, 0x804}, [@IFLA_MTU={0x8, 0x4, 0x6c}, @IFLA_LINKMODE={0x5, 0x11, 0xb}, @IFLA_IFALIASn={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x44000) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r1}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x11, &(0x7f0000000840)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x75}, @snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000000c0)='tlb_flush\x00', r4}, 0x10) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) (async) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r2 = socket(0x15, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x2715, 0x0, &(0x7f0000000000)) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) (async) r3 = socket$tipc(0x1e, 0x5, 0x0) syz_emit_ethernet(0x8e, &(0x7f0000000380)={@local, @remote, @val={@void, {0x8100, 0x2, 0x1}}, {@llc={0x4, {@snap={0xaa, 0xaa, "a6", "1e63b1", 0x17, "854a2c9eb0e75f511eee29e2d3bdc698f953ffe476ddeb16c495930520120e52a6564849a2b01c197f80b34bd352951c14417c7c195be632824bac5890209b590a32c05a809905bafe6182e2ca2fed36074e8ff21d8265bd8071998870732631558773ec9bd63c8cdd1065ae500811642ed42abe"}}}}}, &(0x7f0000000240)={0x1, 0x1, [0x349, 0x5fd, 0x1c0, 0x563]}) (async) bind$tipc(r3, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) openat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x2a813, r4, 0x0) (async) preadv(r4, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x22, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) (async) ioctl$sock_inet6_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000040)) (async) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r7, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) bind$xdp(r7, &(0x7f0000000100)={0x2c, 0x9, r6}, 0x10) (async) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r8, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0xa4}, {0x6}]}, 0x10) (async) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x42, 0x1}, 0x10) sendmsg$tipc(r0, &(0x7f00000006c0)={&(0x7f0000000540)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x10000000}}, 0x10, 0x0}, 0x0) executing program 3: r0 = socket(0x2a, 0x3, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r1, 0x29, 0x4c, &(0x7f0000000540)=ANY=[], 0x60) sendto$inet6(r0, &(0x7f0000000080)="7800000018002507b9409b14ffff00000202be04020506050e130204430009003f0020480a0000000d0085a168d0bf46d32345653600648d27000b000a00000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a3200040016000b000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r2, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x854}, 0x1) sendto$inet6(r0, &(0x7f00000001c0)="020ff3c63a9fae7a920057af134180ea10fb88e703ae6c10ad7b3106544060587d87aba5c8fb2bfcaa68ea68cbc8c820d42da8c13a4040e9485b54bffdcabc88ba33fcd13806c9fcc0645ee4a730cc89dd039f8e70fda358d11ab43cac3fd9340a497c0c2819b37c77e7845a406b485ffbcb6899a864d36ec06be2bcaccfe9797cfb3af4b22d0c0afedb56dcf802b703bdba96fe69abffe300cc76c8a55735024fc7f662e5d1845abefbcc98f34c041d023f211c5f659c5e7401a09a58f64cd30ef2c79001582f7ab3e0db06984b976383", 0xd1, 0x80805, &(0x7f00000002c0)={0xa, 0x4e23, 0x7, @empty, 0x6}, 0x1c) executing program 2: r0 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) (async) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) (async) socketpair(0x28, 0x4, 0x233f, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000080)=0x14) executing program 0: r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3c0, 0x0, 0xe8, 0xe8, 0x2d8, 0x2d8, 0x2d8, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x20, '\x00', 0x0, 0x2d8}}, {{@uncond, 0xc0, 0x100, 0x0, {0x0, 0x1e03}}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "2c3bb27d9d5b379b853c7744b526e29755ec721db80fdb00f95f8a608b8d"}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'netpci0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410) bpf$PROG_LOAD(0x5, &(0x7f0000001780)={0x17, 0xf, &(0x7f0000000240)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x5}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @cgroup_sysctl, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) executing program 3: r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{&(0x7f0000000300)={0x2, 0x4e24, @remote}, 0x10, 0x0}}, {{&(0x7f0000000780)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10, 0x0, 0x0, &(0x7f0000000840)=ANY=[], 0x18}}], 0x2, 0x0) executing program 4: r0 = gettid() r1 = syz_open_procfs$namespace(r0, &(0x7f0000000000)) (async, rerun: 32) r2 = socket(0x2a, 0x2, 0x0) (async, rerun: 32) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x4}}}]}, @NFTA_RULE_COMPAT={0x4}]}], {0x14}}, 0x58}}, 0x0) (async, rerun: 64) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000000000000000000000b00000008000300000000000c00018008000000", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) (async, rerun: 64) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="140100001f000504000000000000000004"], 0x114}], 0x1}, 0x0) (async, rerun: 64) getsockname$packet(r2, 0x0, &(0x7f0000001480)) (rerun: 64) socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x801) socket$netlink(0x10, 0x3, 0x0) mkdirat$cgroup(r1, &(0x7f0000000000)='syz0\x00', 0x1ff) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, &(0x7f0000000000)=ANY=[@ANYRES8=r3], &(0x7f0000000480)='GPL\x00', 0x8000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) executing program 2: bind$rds(0xffffffffffffffff, 0x0, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@ipv4_newrule={0x1c, 0x20, 0x301}, 0x1c}}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r3) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)={0x58, r4, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xfeffffff}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}]}, 0x58}}, 0x0) executing program 3: connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @multicast1}, 0x10) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r0) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000140)=r0, 0x4) (async) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xa0}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000840}, 0x10) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000280)={0x1, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000300)={0x3}, 0x8) (async) syz_genetlink_get_family_id$team(&(0x7f0000000340), r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={'sit0\x00', 0x0, 0x8, 0x7f81, 0x6, 0x180, {{0x15, 0x4, 0x3, 0x1, 0x54, 0x68, 0x0, 0x4, 0x4, 0x0, @broadcast, @rand_addr=0x64010101, {[@noop, @lsrr={0x83, 0x7, 0xa5, [@private=0xa010100]}, @timestamp_addr={0x44, 0xc, 0xa5, 0x1, 0x7, [{@broadcast}]}, @lsrr={0x83, 0x13, 0x73, [@multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, @rand_addr=0x64010102]}, @timestamp={0x44, 0x18, 0x95, 0x0, 0x2, [0x8000, 0x6, 0x4, 0x22, 0xe]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000540)={'erspan0\x00', &(0x7f00000004c0)={'sit0\x00', 0x0, 0x8000, 0x7, 0x529, 0x85, {{0xd, 0x4, 0x2, 0x0, 0x34, 0x64, 0x0, 0x7f, 0x4, 0x0, @local, @empty, {[@generic={0x88, 0x3, "aa"}, @noop, @cipso={0x86, 0x1a, 0x0, [{0x5, 0x8, "12cd51f2018d"}, {0x2, 0x6, "5898bb03"}, {0x1, 0x3, "b9"}, {0x6, 0x3, "d6"}]}]}}}}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000580)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_GET(r4, &(0x7f0000000700)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000006c0)={&(0x7f00000005c0)={0xd4, r5, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@HEADER={0x4}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @HEADER={0x90, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4000}, 0x4) (async) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), r0) sendmsg$TIPC_NL_NET_SET(r4, &(0x7f0000000b40)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000b00)={&(0x7f00000007c0)={0x328, r9, 0x510, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x400}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xef1c}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3945}, @TIPC_NLA_PUBL_TYPE={0x8}]}, @TIPC_NLA_NODE={0xe0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7fffffff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffff7}, @TIPC_NLA_NODE_ID={0xad, 0x3, "2267fc5a0a2e3f17057776f797281c3016432ae67f3087f36b8a6c7d2774658d4f85b95fac8d6ba12a2e6bbd121156b15204862858b6c2117041edd9dec41e869173a38b691119c18bdd66ef7cb58902b34843af067dd55beefd8fdbd6dda99fcf92702142226dbb9be2e255f333788f73b50568eef268f0b6ccf32fa17b3e96db498ac2ee4c58fefd09358f4b9688fbd159896fef1540eca062a8c8aa4a3d458a2b7fd9deec74334a"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x41dc}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x60}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10001}]}, @TIPC_NLA_MEDIA={0xb8, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf70d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x90000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_LINK={0x20, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}]}, @TIPC_NLA_MEDIA={0xcc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x64}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffe}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x44004}, 0x40000) (async) listen(r4, 0xf4) (async) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b80)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x100000, '\x00', r6, 0xffffffffffffffff, 0x3, 0x1, 0x3, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000d00)={r10, &(0x7f0000000c00)="ee8b3c048295044c1c01715e2e6197b1a5d1dc728db2e3e5b38e82a1267ca3da08649f1f36b16054dbac93c9264d6ffb33caf5404d0b543ecf154bc5663a2289d2db2cd4a115c0114e06bc47a37d9275b40113e79942d7a3fd1cea1621f58ffc72e2e4c82dae9a81bdb7afcccfd2832101fd25fece4e600f4c0cfe75103f6d839ce88744133d69933fa6bf44ab55252f8f22ea56b5ddd813ed6da12d72a1983e8588db54201afc5a2b71acd6ff4c", &(0x7f0000000cc0)=""/27}, 0x20) r11 = openat$cgroup_ro(r0, &(0x7f0000000d40)='memory.events.local\x00', 0x0, 0x0) (async) r12 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r12, &(0x7f00000016c0)={&(0x7f0000000d80)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10, &(0x7f0000001280)=[{&(0x7f0000000dc0)=""/41, 0x29}, {&(0x7f0000000e00)=""/90, 0x5a}, {&(0x7f0000000e80)=""/63, 0x3f}, {&(0x7f0000000ec0)=""/79, 0x4f}, {&(0x7f0000000f40)=""/201, 0xc9}, {&(0x7f0000001040)=""/163, 0xa3}, {&(0x7f0000001100)=""/176, 0xb0}, {&(0x7f00000011c0)=""/161, 0xa1}], 0x8, &(0x7f00000015c0)=[@mask_cswp={0x58, 0x114, 0x9, {{0x7, 0x7}, &(0x7f0000001300)=0x5, &(0x7f0000001340)=0x2, 0x3, 0x110, 0x7ff, 0x1, 0x50, 0x7}}, @rdma_args={0x48, 0x114, 0x1, {{0x80000000, 0xf}, {&(0x7f0000001380)=""/166, 0xa6}, &(0x7f0000001500)=[{&(0x7f0000001440)=""/2, 0x2}, {&(0x7f0000001480)=""/114, 0x72}], 0x2, 0x20, 0x7ff}}, @fadd={0x58, 0x114, 0x6, {{0x8, 0xa5fe}, &(0x7f0000001540)=0xfb8c, &(0x7f0000001580)=0x7a04546d, 0xdf, 0x2, 0xa, 0x4, 0x1a, 0x9}}], 0xf8}, 0x48814) (async) setsockopt$ARPT_SO_SET_REPLACE(r11, 0x0, 0x60, &(0x7f0000001740)={'filter\x00', 0x7, 0x4, 0x3d0, 0x0, 0x0, 0x1f8, 0x2e8, 0x2e8, 0x2e8, 0x4, &(0x7f0000001700), {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, 0x4, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7, 0x8}}}, {{@arp={@loopback, @multicast1, 0x0, 0xff000000, 0x5, 0x9, {@empty, {[0x0, 0xff, 0xff, 0x0, 0x0, 0x80]}}, {@mac=@local, {[0xff, 0xff]}}, 0x400, 0x9, 0x6, 0xea1b, 0x8, 0x6, 'ip6_vti0\x00', 'nr0\x00', {}, {}, 0x0, 0x1}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x73, 0xfffffffb, 0x8}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x420) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001b80), r4) socket$pppoe(0x18, 0x1, 0x0) (async) r14 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001c00), r0) sendmsg$L2TP_CMD_SESSION_GET(r11, &(0x7f0000001cc0)={&(0x7f0000001bc0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001c80)={&(0x7f0000001c40)={0x34, r14, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xe}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000004}, 0x40000c0) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r4, &(0x7f0000001e40)={&(0x7f0000001d00)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001e00)={&(0x7f0000001d40)={0xa8, r13, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf0}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x13}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}]}]}, 0xa8}}, 0x4000000) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-openat$tun-ioctl$SIOCGIFHWADDR-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-sendmsg$WG_CMD_SET_DEVICE-socket$nl_generic-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-pipe-socket$inet6-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$inet6-vmsplice-socket$inet6_mptcp-write$cgroup_devices-bind$bt_hci detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 1m40s testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 4, 30, 20, 30, 5, 30, 14, 9, 27, 30, 10, 22, 30, 2, 30, 5, 40, 24, 3, 11, 20, 26, 7, 5, 3, 2, 15, 15, 30] detailed listing: executing program 1: openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000200018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) pipe(&(0x7f0000000000)) socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket(0x1, 0x803, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$rds(0x15, 0x5, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid_for_children\x00') r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000140)=ANY=[@ANYBLOB="44000000150a0309000000000000000000000008090001"], 0x44}, 0x1, 0x0, 0x0, 0x24000819}, 0x40008800) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r5, &(0x7f00000001c0)={&(0x7f0000000300)=@id, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000940)="5763f922081ae50887ede09da114c1daa077f9611f8aa81d1b6fa5f806897377d6aa8524a8b1d8c81597ae6a3411d62b43ead10f470c911e8223cee2d6745ff65b450f8b0b46f900c910f852", 0xff20}, {&(0x7f0000000280)="b57af26468ffde59db204ffaa467c0af523b9e6d93dd62dad3d2f90b45e80eb530982e2a1a0b9ebc2c7113d4f93982f87d0ced6312bdcaa996c13c02d027870ae0bdbed8b104a10605ae3939cfa8e7d4ae5e2f97b5958bed4a4430c01d04f980fac5e88de756ec949e14a35bfb3f32197c05b451", 0x74}, {&(0x7f00000009c0)="3d408cd47846fd99d1d1a4df38e0afdd03a817bf3b4673e575b2c253bae12d98c4d5e4e6d317ba457f2d0de6e1fbc5a43bae0d257cda31fb579139135de49db225bf75a3dea059b4a7a9808dd72eb1bd84d0cf9959907ad6b1e1ec718aa8d5004fd0acd19045d8d6e0f04b6b4497bb3126e4ad0d033ef175a58f55d0993d32bb3a10246c0e9ed8956592d6b51d4c1b3d35b68e6a354f5bdddcb0c943411abe361cd03acfa5d2f09a07700d9ce62314a233dc06de1a", 0xb5}, {&(0x7f0000000a80)="a840c8a67da22f1b2c4e068bb1ad9c499f093b4480b55eb7b9408f5400cc74932ab986ca937640a84378eb6446626516e84b0055936bb61fac109e2624e86903d729b0b10b4f16db7da1fa3aaa808fe333de0c9316c2412cb9ed2d604f8b3fa52416302221487c294ae9dc54783573eb5e7c1027fc39fa60c39afee14fb7cf3e6ef0041470dfd6a4a356a1d7e20a437bcadc7f0b5afa9f9d68bccd88dc02cc0150149950fdf196f5aa69b6c4d17ff0e4f1eb12c021fb1a6ff17ea6cd44b55cae0d9a054286ac6428d5a8d2ec34f045da5e7dbc1f8db2dcc83f53affd659e752b75f3bf443e576a5978614c0ed54741afa3ef7ac2b597143149c19c2fe9130a6f065fa277c2", 0x9c}, {&(0x7f0000000600)="c016c55101fc98bba00b0c2946a2b285871ce0494875c9d8979d34a99a409dcb328a6ff1e31414ec38af8d9348d49550faf55f18c1d9f281054ffbe9a13132e9a05e0542a376762a4d799b6b4f0311f62189f67e7708285a203492767e25e6bc4d28d6d3f8d9f50c2660483f8f942ecb733e84f8619101c2ec2ec357bec450d092e6068a319a9f761d766e6ae151f3f3cb790dda0a6dbc381be1a87e4d992bc55e39f166e65d1a5997bc4d255f00c45f6264f7b459ce6fc78a91f8935fa3aa5fe8be532e06387d82f07e", 0xca}, {&(0x7f0000000700)="f32ced1978f6103c6709573259e317066e84d42f18d090e52035bcf2ddcf8761f30c8179d42f2d06e49766e18561147a88e7ab4a817816b9da02e1744bc7eb653eb04ab70b5bf5111e01923c9bd0f4b72df99f19253083a444b5fbf214a2e9fbbc352a08731643692912aebd09546ccb28837254a30d1e53084dd7f6b7114fa3825fcbae9443ec15fb31bca97a87824d4bc8b632cf971bfb523a", 0x9a}], 0x6, &(0x7f0000000840)="a6d462c399e20d9d7ab19933a9b3d0e1d617be45eb50440e1e51f20cd773cd1b34e2669a511f6292d81a777376560dc1daae580d2419af271bdd485f32ddaa3679178bcbe6ff6f5d5d758535afbe2a930342eaa16108a32d9d31fbfe8bf4d89784440c3ff3fef2f998aebc9634", 0x6d}, 0x80) close(r5) recvmsg(r4, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x101d0}], 0x1, 0x0, 0xfffffffffffffe25}, 0x0) sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000000600)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x23c, 0x13, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_OBJ_USERDATA={0x4e, 0x8, "cc7bcce700116ac2ae434218d6d6f76d8f020ee10251322a2687b5988e023da99cf9aadc7e65db08816fc4b9810b2bff50c46e06d1827d0b08c8e1d05449b3bff40e32706c79e1a43570"}, @NFTA_OBJ_USERDATA={0x26, 0x8, "fe9b0c3b8bbfa879ced36c141f9e1ff9fda1035413ee351da8b9d0fe02f368053729"}, @NFTA_OBJ_USERDATA={0xd4, 0x8, "bd50fbc045da38f1f3370aff5eb2003235c726f048470c3ce3793535adca73403ee3f9d1e716ebbec342ad1915ef537880986309f7ec817a626a20d61248afe54bc0602882bda3d31848f7ad90dc001df7d8750d61e8cf6283462e69661a3183308b2f4fe5db6bb1cbfa931c893f84315f0620ce1512bc1d1b6b065a36d69aad47035570a39ff113482872d4dec3112f3483edff95a2fad821b647d83bf6adc5b1acf8d25d4cb2525678ff36f600d501880935da17ae4304e16dbb9f81e242bd564835f9b406a3ffc5844a595087ffb5"}, @NFTA_OBJ_USERDATA={0xa9, 0x8, "3bf954990a8fe7afffcd5dbba809acdc2ca3e9801c9c691cbee3bc2834f4cae281df53d29269aebd53e55f13c7eee013116a298a217c16fba3187f8c92f4992ebc4414636a54b122788bdfc477aab683fa9047eeb900c3f62810cd43eba756a61b890c912c68abf4542a06711aea69389224ab71c68cb318ad4c6d90b9fce9f499bd81bcc9e75ac137baecbe762682166dcabab6bc3c5c325ce185124e588e59d4cb86a524"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x23c}, 0x1, 0x0, 0x0, 0x4004044}, 0x4004818) socket$inet6_sctp(0xa, 0x1, 0x84) pipe(&(0x7f0000000100)) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c0000003ae16696cfcd61f38f00000304000000003f00000000000000", @ANYRES32=0x0, @ANYBLOB="a5fdad88000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r6, @ANYBLOB], 0x4c}}, 0x0) executing program 4: r0 = socket$kcm(0x10, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@ipv6_getaddrlabel={0x24, 0x4a, 0x1, 0x0, 0x0, {}, [@IFAL_LABEL={0x4}]}, 0x24}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f8480b0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=@newsa={0x10c, 0x10, 0x1, 0x0, 0x0, {{@in=@local, @in=@local}, {@in6=@private1, 0x0, 0x3c}, @in=@dev, {}, {0x0, 0x0, 0x0, 0x5}, {}, 0x0, 0x0, 0xa, 0x2}, [@coaddr={0x14, 0xe, @in6=@ipv4={'\x00', '\xff\xff', @loopback}}, @XFRMA_SET_MARK={0x8}]}, 0x10c}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x13, 0x4, &(0x7f0000000040)=ANY=[], 0x0, 0x800fc5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r2 = openat$cgroup_devices(r1, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x1) sendfile(r3, r2, &(0x7f00000003c0)=0x4000000001ff, 0x10000) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005d80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000000)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x88000, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'lo\x00', 0x1000}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000042e67ca8f39352320b318b0766fc6f9373230950f1d71b89d69c6ec4807fa578697a2fe29c36e3aec21422582697b5e8fd5d6046990852aaf668ce4331"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xa, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000095000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) writev(0xffffffffffffffff, &(0x7f00000002c0), 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000000)) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x100) r7 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r7, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x18}, 0x0) listen(r7, 0x2f3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x3a8, 0x0, 0xc8, 0x8, 0x180, 0x5803, 0x2d8, 0x2e8, 0x2e8, 0x2d8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @private1, [], [], 'pim6reg0\x00', 'wlan0\x00'}, 0x0, 0x118, 0x180, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@pkttype={{0x28}, {0x7, 0xddad}}, @common=@dst={{0x48}, {0x4}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x0, 0x0, 0x0, 'pptp\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x138, 0x158, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'dvmrp0\x00', 'batadv_slave_1\x00', 0x12, 0x3}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000002304e800000000000000ea850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r2) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)={0x14, r3, 0x1, 0x20}, 0x14}}, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f00000004c0)='svcrdma_decode_rseg\x00', r1, 0x0, 0x188158f2}, 0x18) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f00000001c0)='netlink_extack\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x1c, 0x3c, 0x107, 0xfffffffd, 0x0, {0x3, 0x7c}, [@nested={0x4, 0x7a}, @nested={0x4, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x488c0}, 0x24040880) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'ip6gre0\x00', r6, 0x0, 0x0, 0x0, 0x0, 0x0, @private0, @private0, 0x7800, 0x8, 0x7, 0x7}}) unshare(0x22020400) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) unshare(0x20400) (async, rerun: 32) close(r7) (async, rerun: 32) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@deltfilter={0x30, 0x2d, 0x1, 0x0, 0x0, {}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r1}, 0x10) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket(0x15, 0xf, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = syz_init_net_socket$x25(0x3, 0x5, 0x3) ioctl$SIOCX25SFACILITIES(r5, 0x89e3, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000880)=@nat={'nat\x00', 0x19, 0x2, 0x348, [0x20000280, 0x0, 0x0, 0x200002b0, 0x200002e0], 0x2, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="29000000000000000000000000000021000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000400000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000300000000000000ffff0000000000000000000000000000000062726983676530000000000000000000736974300000000000000000000000007465616d300000000000000000000000aaaaaaaaaaaa000000000000aaaaaaaaaabb0000000000000000d8010000d801000010020000636f6d6d656e7400000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073746174697374696300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff000000001b0000000000000000007465616d5f736c6176655f310000000069726c616e300000000000000000000069726c616e3000e575dd73000000000073797a6b616c6c6572300000000000000180c2000000000000000000f646793b7b3900000000000000007000000070000000a8000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff00000000"]}, 0x3c0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002c0001000000000000000000040100800c0000000000000000000000140001000100000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c226237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb64"], 0x114}], 0x1}, 0x0) r6 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000700), 0x4) bpf$ITER_CREATE(0x21, &(0x7f0000000840)={r6}, 0x8) syz_genetlink_get_family_id$ethtool(&(0x7f0000000800), r0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000600)={'syztnl2\x00', &(0x7f0000000980)={'gretap0\x00', 0x0, 0x7800, 0x8, 0x80000000, 0x6, {{0x1e, 0x4, 0x1, 0x0, 0x78, 0x65, 0x0, 0x7, 0x2f, 0x0, @rand_addr=0x64010102, @local, {[@noop, @timestamp={0x44, 0x1c, 0xf5, 0x0, 0xe, [0x2, 0x5, 0x5, 0x1a48, 0x5, 0x100]}, @ssrr={0x89, 0x2f, 0x70, [@private=0xa010102, @empty, @multicast1, @multicast1, @empty, @multicast2, @empty, @empty, @local, @broadcast, @multicast2]}, @rr={0x7, 0x17, 0xf4, [@empty, @multicast1, @empty, @broadcast, @remote]}]}}}}}) sendmsg$nl_route(r3, &(0x7f00000006c0)={&(0x7f0000000140), 0xc, &(0x7f0000000680)={&(0x7f0000000c00)=ANY=[@ANYBLOB="78001200060026bd70006f7256855c8f5405e164c0a06d1cebfddbdf250000516664cba3408179557096d7dbac0000a3237d426c1c7177ff4ba7558bc80aedd52b1126f4dcc26e8d97b003900119a31ea5a406789bf62b5d0db99ad1323bfb07519e1c657f32ca02000000a969cd959c7d511fceafdf538a3c353c3566740ac673b063c452981e97c0acd42f16f11d1d8266ed29681d3186685efd6c3471bd6f255d00d25e3daa2b11f52191d4d06d30d62139c957643eeff008bdad78908497997f03d501ec5a73cff4280ca7562d78ae07cc0da184003e0a8bfd0862b50eddcfad66e3d1769530e9e88352f6c6b34b61189250e52f4d23c5a375fdda88f9551a9199be42d6c46cfdb2390a47219a44d41c780b89d712d92feaeba1fe5e89b39cbcd97f05464cc4b092d433cea430ca589018404f33501029f5698ea27816df32f2910b018712e7218c71af2877", @ANYRES32=r7, @ANYBLOB="040000008000030058011680600001800c00090004000000010000000c000400010000000900000014000b008200000000000000070000000000000014000a000000120000000000b6040000000000000c00030007000000090000001000060001000000ff7f000004000000200001801000020000000000120700007f0000000c0004000700000007000000540001801000020000080000f3000000030100000c00090008000000010000000c00050005000000010000001000020009000000b1000000050000000c0009008d000000060000000c00070007000000050000008000018014000a00ffffff7f000000007f00000000000000100006000100000005000000ca0000001000060006000000020000000900000014000a000180000000000000000040cd0000000014000a0001f0ffff00000000f7000000000000000c000700900000000200000014000a00fcffffff000000001000000000000000"], 0x178}, 0x1, 0x0, 0x0, 0x4002}, 0x48040) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4, 0x70bd2c}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r10) r11 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r10) sendmsg$NL802154_CMD_NEW_INTERFACE(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000a40)=ANY=[@ANYBLOB="1400000098df58ba77d3907c3e73fe63fda51c1577f2a2c288aaea9f74b4de7ec7a1f23da382558532c2bae7a320e3ee0294cc568fb8ddd400326223af2d170f628728304f4b58a208cd6f73eb0e9629460511868bc85ad95c5f5b11708c46b0db67868d08d1c323d761de43e914b0dace8626121650dd5d96a12287902009b9865f27f866c4eaf156d0bb6e34d0afacfa668c3d0ba3aab49d718dbcf79ffe44f59c2012e0fa73aa6253b90feb614c9e243012afed445a9611295cbd47e615ce67", @ANYRES16=r11, @ANYBLOB="010000000000000000001c000000"], 0x14}}, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="554b0000000000000000080001800600010000"], 0x28}}, 0x0) r12 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x14, 0x30, 0x53b, 0x70bd2a, 0x0, {0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$ipvs(0x0, r12) sendmsg$IPVS_CMD_GET_INFO(r13, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="010029bd7000fcdbdf250f000000080004000100008008000400530d0000"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4010) sendmsg$IPVS_CMD_SET_CONFIG(r8, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000900)=ANY=[@ANYRESDEC=0x0, @ANYRES64=r13, @ANYBLOB="020035040000fbdbdf250c00000008000600080000000c000180060004004e2400000800060008000000"], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x40) executing program 1: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f0000000b00)="9e17c2977a7873aee9") bpf$PROG_LOAD(0x5, &(0x7f0000001680)={0x1, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="b7000000f8000000bfa300000000000007030000f0ffffff620af0fff8ffffff71a4f0ff000000002d0a0200000000001d400200000000004704000001ed00007b030000000000001d440000000000007a0a00fe00ffffffc3030000e10000009f040000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d66a77ac8daab82167606068067500c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923030000000000000014e72ba7a54f0c33d39000d06a59ff616236fd9aa5b4e377184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049ef6a989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7592566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270fa3d0ee281eaa11ad47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42e54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65807ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91c11ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6cb5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cdb70f617af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028af0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00672f0814bf895e3a6dfbc711243f58a817895f5c4eaf7de8411a831ef65508f416ae3fd1db8386f6aae40515273adcff6196bb45476ec0a5279ed223f772aee25947b1f0d275c0e495b050f10a0b5d19b578a2b4096b9df527211bb39a29224c34a517dc344a195697b0c158d3519c04fe7621ebeef0bc369a1431a90c4117bdfe358e0e869e9f3e5443813261c1c3c78ab2584603e4468de7d0dc93691491050666f4ea5f083a1b281ed230569921856befe07538fbf33f43fa4ad583867bee301ae1e2566ae7a7afb7fc54895a2fef928d91a162affb4d373c7628a2871d7d19eaf06ed5f58f799c8ff391d3752b115073702ee257ade173dd2f736ed5939f219ba42f7650b9a262f6ee4af52aba3e669a835555ea1674f89d7f98ee1a1c7f977e0a93fdf91606d01c1a9dacfd4328502948bed0bc9514e4f66846bc1f245aa5abad88d56679092fee01007cade7ee72a49a498d51a26ba5cf0896cd9143d457262976f682bf31833ee99b5301f349dd2815e76a8b9a6cec5e000bd6bdafcb9536379b6cd0351cfe345abb1f1bce4d15a3f8b2bb447249a6cc5d201a"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000200), 0x8, 0x10, &(0x7f0000000000)={0x2, 0x40000, 0x1, 0xe}, 0xffffffffffffff7d, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2, @void, @value}, 0x15) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000180)=0x2, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x200, @private2, 0x5}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x9, &(0x7f0000001a00)=0x1, 0x4) sendto$inet6(r1, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) r2 = socket$inet(0x2, 0xa, 0xa22) setsockopt$inet_mreqn(r2, 0x0, 0x23, 0x0, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0xffffffc1) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = socket$unix(0x1, 0xfd407b1c7cc76f1b, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x400448de, &(0x7f00000000c0)={0x4, 0x8000, "e30022"}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000040)="05000000010000", 0x7) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r6 = epoll_create(0x800) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r3, &(0x7f00000001c0)={0x10}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000140)='contention_end\x00', r3, 0x0, 0x4}, 0x18) close(r4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='contention_end\x00', r1}, 0x10) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) getsockopt$inet6_tcp_buf(r3, 0x6, 0x1a, 0x0, &(0x7f00000001c0)) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001480)={0x14e8, 0x2b, 0x1, 0x0, 0x0, "", [@nested={0x14d8, 0x4, 0x0, 0x1, [@nested={0x13e0, 0x128, 0x0, 0x1, [@nested={0x1c8, 0x16, 0x0, 0x1, [@generic="a853c9b8abcaf8170bdb47e4629fc3268596303ed2c6b8296f239889391b18dfdcfca64bd04a34bb0a63a7042959100da17c2ccd422cab9f593dc6159a179957783ec1a03e590d77a949200970f35372cd9648314a4938a89e06afe7235c4d166686db14ebf9779c16a76a42f9ec292df0d99c0734f843551096e3b1f73b52b82e9990c312777186ba52af78f4cbfdce6d17224aa8f79ea52af292e4c2a495a24b5cbaaed76c978e67174e3f6f30587fb88bd0bf", @nested={0x4, 0x5c}, @nested={0x4, 0xad}, @generic="265a0a4b0285246634b2d158744a61fad62b3221c539dce88c5260d51237ffe80a67bdd5d070234c1a736e4994fafcfd77a0b89e4edbfc23060ad4a2aae01cf8e5076d5f48ccd6879166dfc05a95308898ca3512b2f94634454bf6a9ea79da9541484df8a2e7c2fffa5fbe095cc4ae6f2a4c1c2fba2368afb1f1187662bec18722d278dac036fe8e197c1a2d8b81f9060831fa1241cd895d88509d31c02443a4b9bf891d9915e552d49343974a97a411650f360399eac84df45a177b0e920fa6e75cbf14d7cf2161c1984361157cb0161cfe6330b34fcbff92adb1d574ed75349338175f62eadd68da3b41a27d37e509", @nested={0x4, 0x23}, @typed={0x8, 0xd7, 0x0, 0x0, @pid=r2}, @nested={0x4, 0x80}, @nested={0x4, 0x30}, @nested={0x4, 0x3c}]}, @nested={0x5c, 0xa1, 0x0, 0x1, [@nested={0x4, 0x147}, @nested={0x4, 0x26}, @typed={0xd, 0xeb, 0x0, 0x0, @binary="03957bb9c8d9de7a49"}, @nested={0x4, 0x5d}, @typed={0x13, 0x29, 0x0, 0x0, @str='contention_end\x00'}, @typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @typed={0xc, 0xa7, 0x0, 0x0, @u64=0x5}, @nested={0x4, 0xd8}, @nested={0x4, 0x12b}]}, @nested={0x53, 0x23, 0x0, 0x1, [@generic="2c26403fd5fed6780d7a6f39428c821feda3698ecbf979e49a14383b4cb7855c11d281", @nested={0x4, 0x136}, @nested={0x4, 0x137}, @typed={0xe, 0xcc, 0x0, 0x0, @str='syzkaller\x00'}, @typed={0x4, 0xf5}, @typed={0x8, 0x131, 0x0, 0x0, @pid}, @typed={0x8, 0x4b, 0x0, 0x0, @u32=0x2}]}, @generic="5007e2d17299b2339b67c16a31004deeab47d6790110f3bca701eeaec10afcf586ab5883fe01a9973bf18fe8dc8edb10dd625479455bb903e032262bd1cefb99bc7d476d240bb2e7d78aaa4f0948977b4e43e41ab037c2997a00742f67f2e28aa5f87c63fe40698988b4e59b0c5bab3a", @generic, @generic="3f6e86e5e08f4599fa6bedbeec4a3ea26bd69816dee6100a171403ab4ff8b9199535d50727f78966ce0e7b25f5d563a00dc602412265d66c0cdcc800ca910bc738b220c9aa6a230d9c81b1d196e169482cb7f5e95b8d5fe523014a08de71dcd22b07667e9b08e78cd6fd226b26ce3721fe480f27fbe3430c6d9abfe0f4dad6999d2a6d5eb91f004fbedd730b1d397afaee", @generic="feca4d8690c2491a0c086f25f27a2bce0cc898f4de62f28269b45923edb4fb9b91bc6978d29af2b0434766d348b00f620f69761b5071760d4df6cb0ef62c4e46216cd48fadfd5592091c313ffe602a8122d7a50946ee2b6d3aa90be7b95d52", @typed={0x4, 0xd1}, @generic="309f64e5392584b66624919d4f257a3e4865f6e3597a3abb2a59ad497cd17add4b84d4ab3d611216ee267385be0f179d8e597f7edb3df214ef238cf3e28d665258d4259736553927bd642e918c1e9850503a08ca4cec42aef309921c7893e4ebe1f041b427472e70481d47daa8a315e1edd54a730ef6eac6d5b499309ae3e2245f362ffb91c9ab91629e7973d51500433e2f71e95c7e0e453e62cc4626897607a768dfbcc1f2b95e37ca5ba76a10549b7136891967336cc2565a005167151d312ec7b515c27efb946f7d82a6633e8ff321bcaa1ba952770d94b74faaa7511714bb504d9700fd0538637bb5e4739ac8ecec54d7f3f8f13601e73cb9fea4615e4025b331b4079d3f6480c35df1f2db641c060c2e3ff61787d92fac7f4aa13058a1691a33f17c16f882294f655f31535c252d54cc6c278ca5f6319e5e351e38108ccdf54b620980356e77ee64f67d6b424cee642fd0d2db34d8cfc7f66d00120379e095d303363aab2ef831acfdf211a9c3d2f2fa59c82bf37d690137dd0f7daa3cd8763b18828a1cdf9b3955a7f79d25048935a33bd75aca76236d65b226f5dfabae613d0e6a0e50a527a7abf8fd1c73d295064e03bd0bfa97d0139d87aed18ef0a359c260168a9f93908d7cff99763c181571d423b0815ff06f46171fd1d09c4813210b69f91d5d95470fb13dba7bb116de09d7de594a181240d2a1a85e9f68d4b48549b555eb739fb5405fa7b29ffcf0fd8e2b034ef94d82ace797a6a2023e73857c287fb16d24d4cffbbb7677ef76790e3daae1eed2a8029e5b8f63c05bd57efdd35e135b52f9e09f3c85179270af01b2840762f5157dfacabf4904690a8a73ec524968f657919bfd606545927a514cded6792c7e71f6d688a67b28cf6deff447a69e38bbda42e1a4dc86f5ec271b399558f51756749f0b03282c38355ef07dd9afcdda91118287da51fff2d0be462fe5b62c8afbadbc43aeb9c3238be20754c2d7ba754aeb7c43b517ee452bc3b27bc5edccd157005075472abe17e27c9b9b4e446d65ec5b12c28ee9b9ec35d114da78850a68e807629bf71355d8c73183587ebdc598d013a94fdd9c790cb8b33ada0a3e9eb0e9c2adc9fab692c7bccfd12ab8b3a4ed824a8ebdff2e8efae531f55f2f3098d2d1297bb98c1fa562c88e0332c95bd5aadef40b0b7e533f02fd8848c2d2d4c656049153e01d593b2978f1b1d4b5e4380e00357afebe28b13cdfcd26907f1a913f807e31c1487dab0675ea1cba6612c8f64276f31f25ed06ac7c2b931c481412c5c460d1737f0212a52efcb3e82ee1baff978ce217f9671faaa478aadee10880a0b5c6ea514fd0beff04d33727c5b8ba62c5a6dcb5745ab6b63534a5d947bd3083a13e69e645ecf5fdc3d6008bf201064e5c73e0ebae9dd2b5b4078125d0f28044c0b7d1362ff49be0e2147cc23cb694757638ac8943a20b53f43a03185eccc083a4cbaa79627a2428dd46a3dd33cd9fb53a89553e5777b52c3ef8e8e69c8cd6546fe23afd03164d5fcb827a09813b9991ef2fbec2c83d5d5fde79a5e23ba03a2ff4f6064bde20fc9da1665cfd471b8a1c41783109217c01eec975e1af63e0e887084db726e556ce533e1d41ac0da89943ada45301bc03f422f5ec632af810f3b7c8eb79927ab551c70851aa90efa6276d17be4071b0051aa516ddfe666c3644b0151487add6436b88b52eeb97302b7176f74661e7b2b416517a552016fd3ee538d4bb7d645cf08386242429ec7fe5f5eb5ee31f0dc3cbe2e125de0f96e3e8185cc3fb7ee314dbd50713a4855ad49ecc1255423fac872fe66c9f2943627969419022337c5b4307c69635fb8fc5ef19420b6f210f609150bf4feb90c269cbff9ff6b68afe9d69158e97a8d994372a09f2c2b081a4c9e7bd038231df5df38f8ca3819852cbb5d51e16249061d1239f01390b429d46e3e8582cb450db40673ce6cc73deef412bc0b444bdbd9a9f996208ce6ad1960bb7547451b485347d71dca57a6b6c285edf206266bcb1f91e2d86cdbbd2abd3f7f7e6b9b74f4f50137d65b6fd2bfe6b9f5dcbeb2f9396c8b2b34aa54544e58f1345d5877f4b56dbbe6bb1c26bf1f42908aa655dbb8c3c97108629c53428afc8dba252639cffb1b841720192aaba4b2f579f10d57110ded8c63e779ee8afe8a612774a3385797fbe836762553e81d840938e7d462feb40d750081a33cb0636fee9f1b6fabdfbcbdbd4d6831f9de349d807544d864e8225eb1bb56ad14efb699676ad3a3bca439f29fe6529ab4eb27a81b7d4be829de597aea299aa23011aba45dc0e57e1710a5f947a30f06085ddd6ed17a95d0c800afbf4b97334db9b06fc342e99a375e082b6a5803c26385d3d4c0c940ecea2d41c36ff3efeac76366a9a2aea261d7dc1443556db5acec0fdafc9b11fd518e25759b5ab4e5b99efd23fa43075c0daccd9f80878771694322c4d929db6f99ca4dbbe699887cb134b051896472ac4ad5980b078a0c108971d7cfc13295a5557a42aa5515c4931192800c2788ca107a42a7b87eedd3e3374bb4ffdc46f53e9bab6bb3ba76b55b392d4cb36c83a2845439398a94160ed4d47006ca0c2b36345e13980e220f5c854bb780bfbc768e6ca202f6873613581ff9e832e12f6e7798a880f42dee72583d303f6bda3f4b92e3f03a5ef3c0eda101b02ebb3244d36a01f151e78a705ee5a694a336bf4ffe54da9fa1d5c6c9abe5d8473d3d25191fbd197ae310d895b4addab4518fb0dbff1d67bcbd12505fc93f3cd8a50f8cfbc66e0c04433a252a6077a7a5b07cc3f4d0f95082e4597a834f6138a416563b02ee55b35751e8a9792a811d91e639dfee39d540b6ded5960f3e70964718db77240f4274a26131632aa97cd48d652f028d00a21400f0ff37af664d9aee71654ff2d17ea6cf2d3bd124fa09189d9b900358dd8b529713a02121666d60776fec6c05fd0e48da3ff20d44151e717137b281b689d56b5a97e38329a6267c9e76632572a1e08f7a09140474c2873f99e863316b8095fc4be0e88c29d6b8ce628417796e48748ab8632902f135ee32b4fcef1ea223628561ad31a4482dac5dd89e716b5cd06399a2f48a08158b673c855c2cf3be808a80cd27975adb25aaf065793ca758f77c595fe69b7bcb39e2d9df18c6bb215997438a2b63e01e720386bdbe0e5a22c64b8f314ae4f929dee694765dd6c60e55c7fffab55a1403d13e437127ba1e90b78ac22ae410a8f6031e5b6daa8f7529c2b1b44c8e8584c8885f19c09d302b9d9efe039236768a92544c0729eb955f82fa3d8c539cccbc68ac6b725bb060792d344d151ce4cf96caa9e32e9537b175c088a9592e724af9975035a7e3490783b44c3f3ae59d423898fe39380f1e729abe3cc25ac211c182e248b5ce8b4ed83f8860cf31a7b7a49302df21e1fbbf47840d10ccd8b3f1edcd29001ac2a2bbb6fb39e857c098f9ab63a394a2f815694e2de1eb3d159c998bc02b6dab5114c83d4c5236293311c15585cd2362db3fc1437be2fbdb7c83aeda6c597c4ba2f88a5b0b8e9b5b88a561a5d43f0418a829e47d5e488790db211701bea51fb72dc1b372efe5cb7f42d31b8dffc8b1abe2a500e8960dbe1f477f4d347062253ff7007d278b4b87deb5f786a3bfe5303004da3d5124fc96ff70e7eba109d9f39ce01d8026a84de8bd94de4c3645e6e9ca0d5895804eb30274f3f3e27adec53b403a3770aed58512fd4bca5fd565a30434b30d124b84846650303be4d4e19ee68927b9746e756c3ce381880df2e68cfb51435a2b52311d03b3564547d8c609604fa941d81b5d711b699718a5ff31e247718c0a653d7d751f53b2687c8cd509da11316e789eb0dfc26ab72eb0adf082a2ad354987f9a8ccf8326513fa5d8f5c85e1d56f474ab1b4677693dfbcb1dba247bef09fe7a8fd3ef110cd35e705fe01eb51f1369b5fca2ebc2133dfbb1f273a1c4c3c89fea73170604c3c6a7a66692563b2116bd1a8418d8a076f2e1ab90fba450f1f0fc72858d4d2db58e16b66b221e8c6fdb2e89783fb382620cbdce4dad8b098134de456250e15d8a84a38504a17252d4b3512a420f63dc4afd8149b70d1e386add4c6e5d8a836c749da4fe4adfdf22df5503d3de9237269f276a27f7745daedb3134ed3e16fa9b9472e54ca5b82f87dad03ba947f655a28d04b14ee937ffc9ed4d1035debe61a64881953af868217ef54d501e8f1c9a44a495faaa525c34312205fe1034cfd921d3cc8e03390394861288421b772198c29da2cb88d505e8e67dd94b6db57c271402a95bd89dadbbd1a51ac46d2e2e586c1b9c6e14ab982a4d3676a84c931a56bc1cddd5b8b3a84d56d6104c73b097799a35e0dcff0338c984ee1d2bf5d9b3d68f69b1e0877128bf5f807a96ad2b6e4306b80ca873fa5c64a80e0d22046e01b8c135737dd8b99ea8fee69c6b0d43be07d58bbb3d838290bc317c24c2da8b1df157543ed1c84fd9611ea972afc42315076fcced07e0fc9ee2df70832a1522a8012f351ee17ac597ad2bb0b4339f711da2d3e9783549ab1455cf5c64294094771ea4e1cc2c5e3a3deb026c6458fe8d2fed3663ee7fec9529ac6caec6720866d5829e4762e348c440c5c7acb94be667f79e123a53acbc6c09b8a8bcb43d652d485cce26f22058e96c0ae27b9b5a0044c633c1868d094ff6c124d4914b6e9c457f249493a3643b65493a3e641eff935a9040012f07e7b4c1ded220ab6e8fe7007f1aa0ec7585b4f4cb96e6dbe392d611202a40cd647cfe4195a3af687ef525801b804fd9167d0753181184bc78c31ea659c4ccfe31256f4c5a636cc68587df244ac3cb9b3261a315d8cbdd473a3f46f263be684a35e962c4f42a530fa6e435517043bdfde2a373031b2a51bb9f0ca354d62b643bf2ec2f2850a12e5f8ef996ef527a2c588dfe3aea1d672983ad8e6c50f75368a26215e36c597555dfb9d3b588109c62d307ecc9cb744c8bc1b19a509b9efc21c5b28adabd21efa1f8e0a789fc629332841fa052759b909378f85d855c82eaead3d8400a8fe835f7308bd038bea66d7b431cc801b818401a21e169fdb8e0c4c8298d4eb7989a7a5c43632f346333b114cebd0b21b85564e5a9ed8a07089841b742b7fe5abaddb114bf2650475338342de9283d19abfd6649ca2dec2354d9879ceb472b29a07e6648fa64c45739fd15e0a9d4e9d91899b1397c13f938769de4f9ab773164dcde5dbafb723018fac9f3271a2abd5a8a8453aacda5530fa39477fbcaa6569dcf67c3385fdda37aa40d9761d8b9cba5cdd04f87cbcb9c3c54f62705e8951080caa74ee44d4588198a424fa7a7742b64bdce771fc88f7df6cb9080694fdbe8e867ae54bc0fecc7bdf99dcd313fa72d4f726a4d9f552c7f18a69f367dabba684b66ca6aecf7a238f1fc7a27ccb6ff377b477aeaa25c888a5d68acddd06ac2085d2b6484eee193ead0d33a7e0c2b0cd612f85d6226168e49972c0146eb677b7a772a71fd2199e653b850646768a96210e7c6c4c02daf1a27950d86fababbf27834dbd0d1f89438c932a3786d1a3f50839072dbbccb66f9f81ee77aff44e89189abb7ebba5ca80cfaf9b8903ed06e302b263073c4389e8d4841382409c08c9628fef02d33bb28c3cbd42a24e3501147aeaab6e0eb80b123fc4ad468d99692fd2817ff303d160d53aac18718c2c3384a3925599684951e8c8c7b7d48aa99dd90d6ef59e72287c6acc4ce670e4e7d4bf24eeb0391000f5b1b8f1c93250109242cd655a01398ad2e4e"]}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@loopback}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8cd1"]}]}, 0x14e8}], 0x1, 0x0, 0x0, 0x11}, 0x0) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) accept$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x3c, r3, 0x1, 0x0, 0x0, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400d5}, 0x0) close(0xffffffffffffffff) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r1, &(0x7f0000004b80)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="82", 0x1}, {&(0x7f00000000c0)="8484", 0x2}], 0x2}}], 0x1, 0x4400c800) sendto$inet6(r1, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102000000000000000000000000ebf5622b060676179bf02a5ca21c9181166a3e561614e54b27d2d16a66c28a808c576265bf5f436e151a08954809c2722084ed8ecfed53615b50bdf78b4a1f5f030efadd9729a5e08439786be6f3ab759e1813b9e146f3a092a05cce"], 0x14}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001640)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x4}}, 0x9c}}, 0x0) recvmmsg(r0, &(0x7f000000c2c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x3a, 0x9, 0x0, 0x0, {0x1}, [@nested={0xc, 0xe0, 0x0, 0x1, [@typed={0x8, 0x5, 0x0, 0x0, @u32=0xf}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0xb0, 0x0, 0x0, @str='!\x00'}]}, @typed={0x8, 0x2, 0x0, 0x0, @ipv4=@broadcast}]}, 0x34}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x23b, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000001200)=[@in6={0xa, 0x4e22, 0x8, @loopback, 0x6}]}, &(0x7f00000011c0)=0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x40, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x93}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x40}}, 0x0) getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000000080)=""/4076, &(0x7f0000000040)=0xfec) socket$key(0xf, 0x3, 0x2) executing program 0: r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x1, 0x0, @void, @value, @void, @value}, 0x50) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r1, &(0x7f00000011c0)="a0", 0x1, 0x4495, &(0x7f00000012c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) shutdown(r1, 0x1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="00000000000000000094000000000000000000000000005fc273680000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x100000, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socket(0x10, 0x80002, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MAX_AGE={0x8, 0x31}]}}}]}, 0x3c}, 0x1, 0xba01}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000007c0), 0xffffffffffffffff) unshare(0x2040400) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000020000000000000000000000850000000f000000850000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r5 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000100100000c000000fa000000000000ff"], 0x18}, 0x40) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f00000001c0)='netfs_rreq_ref\x00', r4}, 0x18) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={r6, 0x0, 0x0}, 0x10) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010027bd7000fcdbdf250f000000063e4961f47cc83e3f3b310000da9d68145b18b8eb452fbd"], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x810) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x2}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) r10 = socket(0x10, 0x3, 0x0) sendmmsg(r10, &(0x7f0000000000), 0x400000000000235, 0x0) executing program 1: socket$inet_smc(0x2b, 0x1, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@multicast, @random="777de85bf4dd", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x8, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_rs}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0xa}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x80, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100e}, @CTA_SEQ_ADJ_REPLY={0x14, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0xe6ba7615268e7f7}]}]}, 0x80}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000300000000000000000100736974001400028008000200ac1e010106000d00ff030000"], 0x40}, 0x1, 0xba01}, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_REMOVE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xac, r3, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xad}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xe0}, @MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x4}, 0x40000) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x1, 0x4, 0x6, 0x3, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\v\x00'/20, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000008c0), &(0x7f0000000b80), 0x2000005, r2}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000340)={r0, &(0x7f0000000640)="87aa0abecf670dceba8f350bf354a5e0dc3faed171d650d741014e148c5b232b6e1b0a6cb160fd117e77447c6de84edd4ef9e41d73cb1ece6b51cb5a6381f90383a1a778718f551a88a06bb3cc44ddf3e081243a0fb4a4696ae33bc125b05f20b4154cf5f9a52d87d4e5dc09d42c2aad5b30703f02e636f48b70d0b2046d64ae5e3a56e7dd95186f098e233dae9c6acc796677d1b4622d6fe67176b654b5ec5e905f50fc31bf0b051dfb7a26a93fa4172112cf67398c0de89d03b804f0adc5a51cd3ef7defa1c197844981daad026a9840606884252ab4105b31ac1f893cfafc1fea6cdcc1848fdd5e8b57d367", &(0x7f0000000740)=""/156}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000a80)=ANY=[@ANYBLOB="1800000000000000000000001000000018150000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005500000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x30e8, 0x3, 0xfffffff9, 0x4080, r3, 0x7, '\x00', r4, 0xffffffffffffffff, 0x1, 0x0, 0x1, 0xd, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000000), 0xcff5, r5}, 0x38) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r6, 0x84, 0x74, &(0x7f00000000c0)={r7, 0x0, 0x10, 0x6, 0xb1aa}, &(0x7f0000000040)=0x18) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000240)={0x0, &(0x7f0000000040)=""/141, &(0x7f0000000500), &(0x7f0000000280), 0x4, r5}, 0x38) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x74, r10, 0x0, 0x11203}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x5, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x10) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x8001, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socket$nl_xfrm(0x10, 0x3, 0x6) r11 = socket$rds(0x15, 0x5, 0x0) bind$rds(r11, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r11, &(0x7f0000001e40)={&(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@rdma_args={0x48, 0x114, 0x1, {{}, {&(0x7f00000014c0)=""/54, 0x36}, &(0x7f0000001540)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1}}, @rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f0000001a00)=[{&(0x7f0000001680)=""/82, 0x52}], 0x1}}], 0x90}, 0x0) r12 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r12, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r12, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r12, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000140)="03", 0x1}], 0x1}}], 0x1, 0x34000811) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r12, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYRES16, @ANYRES32=r12], 0x1000f) executing program 2: r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000580)="fc457c43aa3f7d64673331496d0983b8be420782d9ac4b57e91f62b9dda712d2ef95adf34bc11e0e33b7a5c2842e81cb", 0x30}], 0x1}}, {{&(0x7f0000000780)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10, 0x0, 0x0, &(0x7f0000000840)=ANY=[], 0x18}}], 0x2, 0x0) executing program 3: r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000800)={0x100, r0, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 32) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000020000000000000001000013070000000000000100"/50], 0x0, 0x32, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) (rerun: 32) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) (async, rerun: 32) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffd51, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async, rerun: 32) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) write$cgroup_int(r5, &(0x7f0000000080)=0x8, 0x12) (async, rerun: 64) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="b800000019000100000000000000000000000000000000000000000000000000e000000100000000000000000000000000000081000000000200000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000001"], 0xb8}}, 0x0) (async, rerun: 64) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) sendto(r1, &(0x7f0000000700)="9ab5808857d89c02fb45b512a3e405c6a18df8d13e5cf79d358fffe8a74dfd3756756c4fe8b50d3d96d0f9fa2059f757f3fb9090e0baec4219f1e878f050ffea02cb5f22934621245b9c587a8fe9ae5621d69347763fd81fafa83effdfb5b20c837d4f43ee97ed4ad995b2c03a90e528cc72156df5b7011d5dc7eb9b7cb3572510eb2fce21f1afc000da068a1f27ef4f8667bb6feae9fa6d5c59f3640c51385d818a97c6dce72528a17c83920d3d5a194d8c055e5622100819b50fe0740c2cbbd77139520f776b561443685167d9ca17c0514fdec1df9d5b9708c6db71c861f9fbe708c3946118c89794ffa11aff077ec950d7", 0xf3, 0x804, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000002c0)=0x6003, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080)=[@window, @mss, @sack_perm, @window, @sack_perm, @timestamp, @timestamp, @timestamp], 0x8) (async) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) (async) r6 = socket$inet(0x2, 0x2, 0x1) (async) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r7, &(0x7f0000000100)={0x18, 0x0, {0x2, @local, 'wg0\x00'}}, 0x1e) sendmsg(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)="5500000018007f5f00fe01b2a4a2809302060000ff41fd01040400000a0012000200", 0x22}, {0x0}], 0x2, 0x0, 0x0, 0x7a000000}, 0x0) (async) r8 = socket$kcm(0x21, 0x2, 0x2) (async) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000940)={0x0, 0xe, &(0x7f0000000000)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe55a10a0015400100142603600e1208000b0000000401a80016000800014009001100036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) sendmsg$kcm(r8, &(0x7f0000000080)={&(0x7f0000000000)=@generic={0x25, "4bc475336c5858aa36d22e2605dd52416ad64dea6679d6760eb3ae06eeecab8fb38f5dba7f566ef424bcfc034322e5179b4783cd9ede9144e15085deeab643ea8a8f0048f0be4c32ec727eba69e206dbe9dea8b7cf46938ee7feab499bd8db55f5c530e2d55a128d603119be1625aca347038b73ee81502998f370791659"}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYRES16=r4], 0x18}, 0x8000000) (async, rerun: 32) close(r8) (async, rerun: 32) sendmsg$inet(r6, &(0x7f0000000600)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000002100)="0800a9fc0da6b30a", 0x8}], 0x1, &(0x7f0000001d00)=ANY=[@ANYBLOB="18000000000000000000000002"], 0x30}, 0x0) (async) sendmmsg$inet(r1, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000200)="27fe6da9b9cebbb18bafd9ccd79f0efca7a903c7a6fb41ecbd409f1a3db49cc612de34d4e9a8af95005aee32dbf7b63362533b67d254932beb05349e93971a53b856ce30901dc6d5679605b1dfde5241ca7183a9232bcb8c29e4fa570f53f09a5c34fd7e046ae08a1231a6f5654f2a870ccb697f41bf7a60a68033e80ed7dc6c7c06deecaaf2fbbd4e2bea22582fa90d8d14aa07b40e9c3415afb5", 0x9b}, {&(0x7f0000000100)="ac04048ea155344276", 0x9}, {&(0x7f0000000140)="a3dab3a1efd701da2d9607fa7ae104fe4e788344012ee808a9760da3249ac6", 0x1f}, {&(0x7f0000000300)="f1374fb8259ce1fcd099ef0a9ce716aa1c8be4e98a99f15b8069b924e58f605e96f1e947ecab1f70a511d0868f949bd4f8efe41209d6e6ae2413862ce802da43f9f1520ebded89d4947eb2685f780aa5db2a3728c288", 0x56}, {&(0x7f0000000380)="a58df42e976cc6e43303b58c453196fd57f61c89e96c0ac0ad0c4c19a1b80b2e78bf8fc8a904310f90732a6c316473c27706680d7dbadd7fbeb2a98436b22b99174eb9a36e84e56ddfa1e59ca6b03bcc32c508715075ed74ed334214928bac4f19ffe2a8f6bdef50f19499bd2b31f380b7948507479bd6170e98c4106a5c0edf30fa5e08fdfdb9571231fd07a95edf125df4433624b9e2df35f8d92ceb09a9fbf78fa03e044a99a8c9f4e524cd1ac5148a20575ba9f60acc4459ae3b5d84366dee82a25d7884711d9f7586cafb21b4ac5ce5eb48e31d352deb0e5474dc11", 0xde}, {&(0x7f0000000480)="bfdf8f623b14d1b0d12a6c9decb13220b9ee0af979d90e2ef5aa0ebcbc792d3411da", 0x22}], 0x6}}], 0x1, 0x4008095) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006b00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000200), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x5, 0x413, 0x0, {}, {}, {0x0, 0x0, 0x1}, 0x1, @can={{}, 0x7, 0x7, 0x0, 0x0, "94b1c39a3cc2fbfd"}}, 0x48}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x24, 0x3c, 0x9, 0x0, 0x0, {0x2}, [@typed={0x4, 0x200}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x3, 0x0, 0x0, @uid}]}]}, 0x24}}, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2a, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @val, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x60}}, 0x0) (async) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2a, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @val, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x60}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000000)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="cf0400000000000000001300000008000300", @ANYRES32=r6, @ANYBLOB="0500130092848b000a00060008021100000100000600100080050000060012"], 0x40}, 0x1, 0x0, 0x0, 0xc0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r8, 0x5, 0x3, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0xb4) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000001c40)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2ed0300000000000000af99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14008c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000006da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c4159b364a4fd7013f34db173a4fdacf15229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4978ea8e4aa37014191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be867a28f09c5877fc2355ecdc9c30dcb2d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff3a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb357b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50265a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d9a0e06da200481cde8bf475bc3e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a00"/3590], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x2e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (async) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r11, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000380)=r10}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x8}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r12}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x3a}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) socket$alg(0x26, 0x5, 0x0) (async) r13 = socket$alg(0x26, 0x5, 0x0) bind$alg(r13, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-ssse3\x00'}, 0x58) r14 = accept4(r13, 0x0, 0x0, 0x0) sendmsg$unix(r14, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)="1709f53e25f27116776b40cd3c550d298dd1b9266c15c25b83f011b965bb18efe36db9195a46d7dd34", 0x29}, {&(0x7f0000000240)="8bd751665b27b5ee408c629bceca8e7af4e15e0c93db7c7cf5b0d8bdaf6d95e8f449260f9dd2f4b86bca6d5bc7951cb16b4c5e340be7b089af5481907baf4c757bc0ff04cea7", 0x46}], 0x2}, 0x0) (async) sendmsg$unix(r14, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)="1709f53e25f27116776b40cd3c550d298dd1b9266c15c25b83f011b965bb18efe36db9195a46d7dd34", 0x29}, {&(0x7f0000000240)="8bd751665b27b5ee408c629bceca8e7af4e15e0c93db7c7cf5b0d8bdaf6d95e8f449260f9dd2f4b86bca6d5bc7951cb16b4c5e340be7b089af5481907baf4c757bc0ff04cea7", 0x46}], 0x2}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r9}, 0xa) r15 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r15, 0x8916, &(0x7f0000000200)={'veth1_to_batadv\x00', {0x2, 0x4e21, @broadcast}}) r16 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r16, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r16, &(0x7f0000000340)="24000000010001", 0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7a}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) executing program 3: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0xc, @broadcast, 'veth1_to_team\x00'}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x101a40, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f00000000c0)=0x1) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x2) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000000100)) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0xfec2, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6gre0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc890}, 0x20000000) socket$pppoe(0x18, 0x1, 0x0) (async) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0xc, @broadcast, 'veth1_to_team\x00'}}, 0x1e) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x101a40, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0) (async) socket$pppoe(0x18, 0x1, 0x0) (async) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f00000000c0)=0x1) (async) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x2) (async) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000000100)) (async) socket$nl_rdma(0x10, 0x3, 0x14) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0xfec2, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6gre0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc890}, 0x20000000) (async) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newlink={0x48, 0x10, 0x439, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2404}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}]}, 0x48}}, 0x4050) socket$inet6(0xa, 0x3, 0xffffffff) executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x4ca31, 0xffffffffffffffff, 0x0) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2711, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtaction={0x64, 0x30, 0x9, 0x0, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x1, 0x10000, 0x10000000, 0x1, 0x5}, 0x4}}]}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x64}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'syztnl0\x00', 0x0, 0x29, 0xfa, 0xfd, 0xfffffffc, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, 0x7800, 0x80, 0x4b0c, 0x3ba}}) sendmsg$nl_route(r2, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40020000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@bridge_getlink={0x34, 0x12, 0x20, 0x70bd27, 0x25dfdbfc, {0x7, 0x0, 0x0, r3, 0x20831, 0x804}, [@IFLA_MTU={0x8, 0x4, 0x6c}, @IFLA_LINKMODE={0x5, 0x11, 0xb}, @IFLA_IFALIASn={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x44000) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r1}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x11, &(0x7f0000000840)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x75}, @snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000000c0)='tlb_flush\x00', r4}, 0x10) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) (async) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r2 = socket(0x15, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x2715, 0x0, &(0x7f0000000000)) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) (async) r3 = socket$tipc(0x1e, 0x5, 0x0) syz_emit_ethernet(0x8e, &(0x7f0000000380)={@local, @remote, @val={@void, {0x8100, 0x2, 0x1}}, {@llc={0x4, {@snap={0xaa, 0xaa, "a6", "1e63b1", 0x17, "854a2c9eb0e75f511eee29e2d3bdc698f953ffe476ddeb16c495930520120e52a6564849a2b01c197f80b34bd352951c14417c7c195be632824bac5890209b590a32c05a809905bafe6182e2ca2fed36074e8ff21d8265bd8071998870732631558773ec9bd63c8cdd1065ae500811642ed42abe"}}}}}, &(0x7f0000000240)={0x1, 0x1, [0x349, 0x5fd, 0x1c0, 0x563]}) (async) bind$tipc(r3, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) openat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x2a813, r4, 0x0) (async) preadv(r4, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x22, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) (async) ioctl$sock_inet6_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000040)) (async) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r7, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) bind$xdp(r7, &(0x7f0000000100)={0x2c, 0x9, r6}, 0x10) (async) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r8, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0xa4}, {0x6}]}, 0x10) (async) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x42, 0x1}, 0x10) sendmsg$tipc(r0, &(0x7f00000006c0)={&(0x7f0000000540)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x10000000}}, 0x10, 0x0}, 0x0) executing program 3: r0 = socket(0x2a, 0x3, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r1, 0x29, 0x4c, &(0x7f0000000540)=ANY=[], 0x60) sendto$inet6(r0, &(0x7f0000000080)="7800000018002507b9409b14ffff00000202be04020506050e130204430009003f0020480a0000000d0085a168d0bf46d32345653600648d27000b000a00000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a3200040016000b000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r2, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x854}, 0x1) sendto$inet6(r0, &(0x7f00000001c0)="020ff3c63a9fae7a920057af134180ea10fb88e703ae6c10ad7b3106544060587d87aba5c8fb2bfcaa68ea68cbc8c820d42da8c13a4040e9485b54bffdcabc88ba33fcd13806c9fcc0645ee4a730cc89dd039f8e70fda358d11ab43cac3fd9340a497c0c2819b37c77e7845a406b485ffbcb6899a864d36ec06be2bcaccfe9797cfb3af4b22d0c0afedb56dcf802b703bdba96fe69abffe300cc76c8a55735024fc7f662e5d1845abefbcc98f34c041d023f211c5f659c5e7401a09a58f64cd30ef2c79001582f7ab3e0db06984b976383", 0xd1, 0x80805, &(0x7f00000002c0)={0xa, 0x4e23, 0x7, @empty, 0x6}, 0x1c) executing program 2: r0 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) (async) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) (async) socketpair(0x28, 0x4, 0x233f, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000080)=0x14) executing program 0: r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3c0, 0x0, 0xe8, 0xe8, 0x2d8, 0x2d8, 0x2d8, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x20, '\x00', 0x0, 0x2d8}}, {{@uncond, 0xc0, 0x100, 0x0, {0x0, 0x1e03}}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "2c3bb27d9d5b379b853c7744b526e29755ec721db80fdb00f95f8a608b8d"}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'netpci0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410) bpf$PROG_LOAD(0x5, &(0x7f0000001780)={0x17, 0xf, &(0x7f0000000240)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x5}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @cgroup_sysctl, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) executing program 3: r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{&(0x7f0000000300)={0x2, 0x4e24, @remote}, 0x10, 0x0}}, {{&(0x7f0000000780)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10, 0x0, 0x0, &(0x7f0000000840)=ANY=[], 0x18}}], 0x2, 0x0) executing program 4: r0 = gettid() r1 = syz_open_procfs$namespace(r0, &(0x7f0000000000)) (async, rerun: 32) r2 = socket(0x2a, 0x2, 0x0) (async, rerun: 32) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x4}}}]}, @NFTA_RULE_COMPAT={0x4}]}], {0x14}}, 0x58}}, 0x0) (async, rerun: 64) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000000000000000000000b00000008000300000000000c00018008000000", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) (async, rerun: 64) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="140100001f000504000000000000000004"], 0x114}], 0x1}, 0x0) (async, rerun: 64) getsockname$packet(r2, 0x0, &(0x7f0000001480)) (rerun: 64) socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x801) socket$netlink(0x10, 0x3, 0x0) mkdirat$cgroup(r1, &(0x7f0000000000)='syz0\x00', 0x1ff) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, &(0x7f0000000000)=ANY=[@ANYRES8=r3], &(0x7f0000000480)='GPL\x00', 0x8000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) executing program 2: bind$rds(0xffffffffffffffff, 0x0, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@ipv4_newrule={0x1c, 0x20, 0x301}, 0x1c}}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r3) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)={0x58, r4, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xfeffffff}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}]}, 0x58}}, 0x0) executing program 3: connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @multicast1}, 0x10) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r0) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000140)=r0, 0x4) (async) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xa0}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000840}, 0x10) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000280)={0x1, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000300)={0x3}, 0x8) (async) syz_genetlink_get_family_id$team(&(0x7f0000000340), r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={'sit0\x00', 0x0, 0x8, 0x7f81, 0x6, 0x180, {{0x15, 0x4, 0x3, 0x1, 0x54, 0x68, 0x0, 0x4, 0x4, 0x0, @broadcast, @rand_addr=0x64010101, {[@noop, @lsrr={0x83, 0x7, 0xa5, [@private=0xa010100]}, @timestamp_addr={0x44, 0xc, 0xa5, 0x1, 0x7, [{@broadcast}]}, @lsrr={0x83, 0x13, 0x73, [@multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, @rand_addr=0x64010102]}, @timestamp={0x44, 0x18, 0x95, 0x0, 0x2, [0x8000, 0x6, 0x4, 0x22, 0xe]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000540)={'erspan0\x00', &(0x7f00000004c0)={'sit0\x00', 0x0, 0x8000, 0x7, 0x529, 0x85, {{0xd, 0x4, 0x2, 0x0, 0x34, 0x64, 0x0, 0x7f, 0x4, 0x0, @local, @empty, {[@generic={0x88, 0x3, "aa"}, @noop, @cipso={0x86, 0x1a, 0x0, [{0x5, 0x8, "12cd51f2018d"}, {0x2, 0x6, "5898bb03"}, {0x1, 0x3, "b9"}, {0x6, 0x3, "d6"}]}]}}}}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000580)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_GET(r4, &(0x7f0000000700)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000006c0)={&(0x7f00000005c0)={0xd4, r5, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@HEADER={0x4}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @HEADER={0x90, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4000}, 0x4) (async) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), r0) sendmsg$TIPC_NL_NET_SET(r4, &(0x7f0000000b40)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000b00)={&(0x7f00000007c0)={0x328, r9, 0x510, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x400}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xef1c}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3945}, @TIPC_NLA_PUBL_TYPE={0x8}]}, @TIPC_NLA_NODE={0xe0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7fffffff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffff7}, @TIPC_NLA_NODE_ID={0xad, 0x3, "2267fc5a0a2e3f17057776f797281c3016432ae67f3087f36b8a6c7d2774658d4f85b95fac8d6ba12a2e6bbd121156b15204862858b6c2117041edd9dec41e869173a38b691119c18bdd66ef7cb58902b34843af067dd55beefd8fdbd6dda99fcf92702142226dbb9be2e255f333788f73b50568eef268f0b6ccf32fa17b3e96db498ac2ee4c58fefd09358f4b9688fbd159896fef1540eca062a8c8aa4a3d458a2b7fd9deec74334a"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x41dc}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x60}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10001}]}, @TIPC_NLA_MEDIA={0xb8, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf70d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x90000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_LINK={0x20, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}]}, @TIPC_NLA_MEDIA={0xcc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x64}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffe}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x44004}, 0x40000) (async) listen(r4, 0xf4) (async) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b80)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x100000, '\x00', r6, 0xffffffffffffffff, 0x3, 0x1, 0x3, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000d00)={r10, &(0x7f0000000c00)="ee8b3c048295044c1c01715e2e6197b1a5d1dc728db2e3e5b38e82a1267ca3da08649f1f36b16054dbac93c9264d6ffb33caf5404d0b543ecf154bc5663a2289d2db2cd4a115c0114e06bc47a37d9275b40113e79942d7a3fd1cea1621f58ffc72e2e4c82dae9a81bdb7afcccfd2832101fd25fece4e600f4c0cfe75103f6d839ce88744133d69933fa6bf44ab55252f8f22ea56b5ddd813ed6da12d72a1983e8588db54201afc5a2b71acd6ff4c", &(0x7f0000000cc0)=""/27}, 0x20) r11 = openat$cgroup_ro(r0, &(0x7f0000000d40)='memory.events.local\x00', 0x0, 0x0) (async) r12 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r12, &(0x7f00000016c0)={&(0x7f0000000d80)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10, &(0x7f0000001280)=[{&(0x7f0000000dc0)=""/41, 0x29}, {&(0x7f0000000e00)=""/90, 0x5a}, {&(0x7f0000000e80)=""/63, 0x3f}, {&(0x7f0000000ec0)=""/79, 0x4f}, {&(0x7f0000000f40)=""/201, 0xc9}, {&(0x7f0000001040)=""/163, 0xa3}, {&(0x7f0000001100)=""/176, 0xb0}, {&(0x7f00000011c0)=""/161, 0xa1}], 0x8, &(0x7f00000015c0)=[@mask_cswp={0x58, 0x114, 0x9, {{0x7, 0x7}, &(0x7f0000001300)=0x5, &(0x7f0000001340)=0x2, 0x3, 0x110, 0x7ff, 0x1, 0x50, 0x7}}, @rdma_args={0x48, 0x114, 0x1, {{0x80000000, 0xf}, {&(0x7f0000001380)=""/166, 0xa6}, &(0x7f0000001500)=[{&(0x7f0000001440)=""/2, 0x2}, {&(0x7f0000001480)=""/114, 0x72}], 0x2, 0x20, 0x7ff}}, @fadd={0x58, 0x114, 0x6, {{0x8, 0xa5fe}, &(0x7f0000001540)=0xfb8c, &(0x7f0000001580)=0x7a04546d, 0xdf, 0x2, 0xa, 0x4, 0x1a, 0x9}}], 0xf8}, 0x48814) (async) setsockopt$ARPT_SO_SET_REPLACE(r11, 0x0, 0x60, &(0x7f0000001740)={'filter\x00', 0x7, 0x4, 0x3d0, 0x0, 0x0, 0x1f8, 0x2e8, 0x2e8, 0x2e8, 0x4, &(0x7f0000001700), {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, 0x4, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7, 0x8}}}, {{@arp={@loopback, @multicast1, 0x0, 0xff000000, 0x5, 0x9, {@empty, {[0x0, 0xff, 0xff, 0x0, 0x0, 0x80]}}, {@mac=@local, {[0xff, 0xff]}}, 0x400, 0x9, 0x6, 0xea1b, 0x8, 0x6, 'ip6_vti0\x00', 'nr0\x00', {}, {}, 0x0, 0x1}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x73, 0xfffffffb, 0x8}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x420) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001b80), r4) socket$pppoe(0x18, 0x1, 0x0) (async) r14 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001c00), r0) sendmsg$L2TP_CMD_SESSION_GET(r11, &(0x7f0000001cc0)={&(0x7f0000001bc0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001c80)={&(0x7f0000001c40)={0x34, r14, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xe}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000004}, 0x40000c0) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r4, &(0x7f0000001e40)={&(0x7f0000001d00)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001e00)={&(0x7f0000001d40)={0xa8, r13, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf0}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x13}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}]}]}, 0xa8}}, 0x4000000) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-openat$tun-ioctl$SIOCGIFHWADDR-socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-socket$nl_generic-syz_genetlink_get_family_id$wireguard-ioctl$ifreq_SIOCGIFINDEX_wireguard-sendmsg$WG_CMD_SET_DEVICE-socket$nl_generic-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-pipe-socket$inet6-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$inet6-vmsplice-socket$inet6_mptcp-write$cgroup_devices-bind$bt_hci detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 6m0s testing program (duration=6m7s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 4, 30, 20, 30, 5, 30, 14, 9, 27, 30, 10, 22, 30, 2, 30, 5, 40, 24, 3, 11, 20, 26, 7, 5, 3, 2, 15, 15, 30] detailed listing: executing program 1: openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000200018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) pipe(&(0x7f0000000000)) socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket(0x1, 0x803, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$rds(0x15, 0x5, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid_for_children\x00') r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000140)=ANY=[@ANYBLOB="44000000150a0309000000000000000000000008090001"], 0x44}, 0x1, 0x0, 0x0, 0x24000819}, 0x40008800) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r5, &(0x7f00000001c0)={&(0x7f0000000300)=@id, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000940)="5763f922081ae50887ede09da114c1daa077f9611f8aa81d1b6fa5f806897377d6aa8524a8b1d8c81597ae6a3411d62b43ead10f470c911e8223cee2d6745ff65b450f8b0b46f900c910f852", 0xff20}, {&(0x7f0000000280)="b57af26468ffde59db204ffaa467c0af523b9e6d93dd62dad3d2f90b45e80eb530982e2a1a0b9ebc2c7113d4f93982f87d0ced6312bdcaa996c13c02d027870ae0bdbed8b104a10605ae3939cfa8e7d4ae5e2f97b5958bed4a4430c01d04f980fac5e88de756ec949e14a35bfb3f32197c05b451", 0x74}, {&(0x7f00000009c0)="3d408cd47846fd99d1d1a4df38e0afdd03a817bf3b4673e575b2c253bae12d98c4d5e4e6d317ba457f2d0de6e1fbc5a43bae0d257cda31fb579139135de49db225bf75a3dea059b4a7a9808dd72eb1bd84d0cf9959907ad6b1e1ec718aa8d5004fd0acd19045d8d6e0f04b6b4497bb3126e4ad0d033ef175a58f55d0993d32bb3a10246c0e9ed8956592d6b51d4c1b3d35b68e6a354f5bdddcb0c943411abe361cd03acfa5d2f09a07700d9ce62314a233dc06de1a", 0xb5}, {&(0x7f0000000a80)="a840c8a67da22f1b2c4e068bb1ad9c499f093b4480b55eb7b9408f5400cc74932ab986ca937640a84378eb6446626516e84b0055936bb61fac109e2624e86903d729b0b10b4f16db7da1fa3aaa808fe333de0c9316c2412cb9ed2d604f8b3fa52416302221487c294ae9dc54783573eb5e7c1027fc39fa60c39afee14fb7cf3e6ef0041470dfd6a4a356a1d7e20a437bcadc7f0b5afa9f9d68bccd88dc02cc0150149950fdf196f5aa69b6c4d17ff0e4f1eb12c021fb1a6ff17ea6cd44b55cae0d9a054286ac6428d5a8d2ec34f045da5e7dbc1f8db2dcc83f53affd659e752b75f3bf443e576a5978614c0ed54741afa3ef7ac2b597143149c19c2fe9130a6f065fa277c2", 0x9c}, {&(0x7f0000000600)="c016c55101fc98bba00b0c2946a2b285871ce0494875c9d8979d34a99a409dcb328a6ff1e31414ec38af8d9348d49550faf55f18c1d9f281054ffbe9a13132e9a05e0542a376762a4d799b6b4f0311f62189f67e7708285a203492767e25e6bc4d28d6d3f8d9f50c2660483f8f942ecb733e84f8619101c2ec2ec357bec450d092e6068a319a9f761d766e6ae151f3f3cb790dda0a6dbc381be1a87e4d992bc55e39f166e65d1a5997bc4d255f00c45f6264f7b459ce6fc78a91f8935fa3aa5fe8be532e06387d82f07e", 0xca}, {&(0x7f0000000700)="f32ced1978f6103c6709573259e317066e84d42f18d090e52035bcf2ddcf8761f30c8179d42f2d06e49766e18561147a88e7ab4a817816b9da02e1744bc7eb653eb04ab70b5bf5111e01923c9bd0f4b72df99f19253083a444b5fbf214a2e9fbbc352a08731643692912aebd09546ccb28837254a30d1e53084dd7f6b7114fa3825fcbae9443ec15fb31bca97a87824d4bc8b632cf971bfb523a", 0x9a}], 0x6, &(0x7f0000000840)="a6d462c399e20d9d7ab19933a9b3d0e1d617be45eb50440e1e51f20cd773cd1b34e2669a511f6292d81a777376560dc1daae580d2419af271bdd485f32ddaa3679178bcbe6ff6f5d5d758535afbe2a930342eaa16108a32d9d31fbfe8bf4d89784440c3ff3fef2f998aebc9634", 0x6d}, 0x80) close(r5) recvmsg(r4, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x101d0}], 0x1, 0x0, 0xfffffffffffffe25}, 0x0) sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000000600)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x23c, 0x13, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_OBJ_USERDATA={0x4e, 0x8, "cc7bcce700116ac2ae434218d6d6f76d8f020ee10251322a2687b5988e023da99cf9aadc7e65db08816fc4b9810b2bff50c46e06d1827d0b08c8e1d05449b3bff40e32706c79e1a43570"}, @NFTA_OBJ_USERDATA={0x26, 0x8, "fe9b0c3b8bbfa879ced36c141f9e1ff9fda1035413ee351da8b9d0fe02f368053729"}, @NFTA_OBJ_USERDATA={0xd4, 0x8, "bd50fbc045da38f1f3370aff5eb2003235c726f048470c3ce3793535adca73403ee3f9d1e716ebbec342ad1915ef537880986309f7ec817a626a20d61248afe54bc0602882bda3d31848f7ad90dc001df7d8750d61e8cf6283462e69661a3183308b2f4fe5db6bb1cbfa931c893f84315f0620ce1512bc1d1b6b065a36d69aad47035570a39ff113482872d4dec3112f3483edff95a2fad821b647d83bf6adc5b1acf8d25d4cb2525678ff36f600d501880935da17ae4304e16dbb9f81e242bd564835f9b406a3ffc5844a595087ffb5"}, @NFTA_OBJ_USERDATA={0xa9, 0x8, "3bf954990a8fe7afffcd5dbba809acdc2ca3e9801c9c691cbee3bc2834f4cae281df53d29269aebd53e55f13c7eee013116a298a217c16fba3187f8c92f4992ebc4414636a54b122788bdfc477aab683fa9047eeb900c3f62810cd43eba756a61b890c912c68abf4542a06711aea69389224ab71c68cb318ad4c6d90b9fce9f499bd81bcc9e75ac137baecbe762682166dcabab6bc3c5c325ce185124e588e59d4cb86a524"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x23c}, 0x1, 0x0, 0x0, 0x4004044}, 0x4004818) socket$inet6_sctp(0xa, 0x1, 0x84) pipe(&(0x7f0000000100)) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c0000003ae16696cfcd61f38f00000304000000003f00000000000000", @ANYRES32=0x0, @ANYBLOB="a5fdad88000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r6, @ANYBLOB], 0x4c}}, 0x0) executing program 4: r0 = socket$kcm(0x10, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@ipv6_getaddrlabel={0x24, 0x4a, 0x1, 0x0, 0x0, {}, [@IFAL_LABEL={0x4}]}, 0x24}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f8480b0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=@newsa={0x10c, 0x10, 0x1, 0x0, 0x0, {{@in=@local, @in=@local}, {@in6=@private1, 0x0, 0x3c}, @in=@dev, {}, {0x0, 0x0, 0x0, 0x5}, {}, 0x0, 0x0, 0xa, 0x2}, [@coaddr={0x14, 0xe, @in6=@ipv4={'\x00', '\xff\xff', @loopback}}, @XFRMA_SET_MARK={0x8}]}, 0x10c}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x13, 0x4, &(0x7f0000000040)=ANY=[], 0x0, 0x800fc5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r2 = openat$cgroup_devices(r1, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x1) sendfile(r3, r2, &(0x7f00000003c0)=0x4000000001ff, 0x10000) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005d80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000000)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x88000, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'lo\x00', 0x1000}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000042e67ca8f39352320b318b0766fc6f9373230950f1d71b89d69c6ec4807fa578697a2fe29c36e3aec21422582697b5e8fd5d6046990852aaf668ce4331"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xa, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000095000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) writev(0xffffffffffffffff, &(0x7f00000002c0), 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000000)) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x100) r7 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r7, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x18}, 0x0) listen(r7, 0x2f3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x3a8, 0x0, 0xc8, 0x8, 0x180, 0x5803, 0x2d8, 0x2e8, 0x2e8, 0x2d8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @private1, [], [], 'pim6reg0\x00', 'wlan0\x00'}, 0x0, 0x118, 0x180, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@pkttype={{0x28}, {0x7, 0xddad}}, @common=@dst={{0x48}, {0x4}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x0, 0x0, 0x0, 'pptp\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x138, 0x158, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'dvmrp0\x00', 'batadv_slave_1\x00', 0x12, 0x3}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000002304e800000000000000ea850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r2) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)={0x14, r3, 0x1, 0x20}, 0x14}}, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f00000004c0)='svcrdma_decode_rseg\x00', r1, 0x0, 0x188158f2}, 0x18) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f00000001c0)='netlink_extack\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x1c, 0x3c, 0x107, 0xfffffffd, 0x0, {0x3, 0x7c}, [@nested={0x4, 0x7a}, @nested={0x4, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x488c0}, 0x24040880) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'ip6gre0\x00', r6, 0x0, 0x0, 0x0, 0x0, 0x0, @private0, @private0, 0x7800, 0x8, 0x7, 0x7}}) unshare(0x22020400) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) unshare(0x20400) (async, rerun: 32) close(r7) (async, rerun: 32) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@deltfilter={0x30, 0x2d, 0x1, 0x0, 0x0, {}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r1}, 0x10) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket(0x15, 0xf, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = syz_init_net_socket$x25(0x3, 0x5, 0x3) ioctl$SIOCX25SFACILITIES(r5, 0x89e3, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000880)=@nat={'nat\x00', 0x19, 0x2, 0x348, [0x20000280, 0x0, 0x0, 0x200002b0, 0x200002e0], 0x2, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="29000000000000000000000000000021000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000400000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000300000000000000ffff0000000000000000000000000000000062726983676530000000000000000000736974300000000000000000000000007465616d300000000000000000000000aaaaaaaaaaaa000000000000aaaaaaaaaabb0000000000000000d8010000d801000010020000636f6d6d656e7400000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073746174697374696300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff000000001b0000000000000000007465616d5f736c6176655f310000000069726c616e300000000000000000000069726c616e3000e575dd73000000000073797a6b616c6c6572300000000000000180c2000000000000000000f646793b7b3900000000000000007000000070000000a8000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff00000000"]}, 0x3c0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002c0001000000000000000000040100800c0000000000000000000000140001000100000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c226237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb64"], 0x114}], 0x1}, 0x0) r6 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000700), 0x4) bpf$ITER_CREATE(0x21, &(0x7f0000000840)={r6}, 0x8) syz_genetlink_get_family_id$ethtool(&(0x7f0000000800), r0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000600)={'syztnl2\x00', &(0x7f0000000980)={'gretap0\x00', 0x0, 0x7800, 0x8, 0x80000000, 0x6, {{0x1e, 0x4, 0x1, 0x0, 0x78, 0x65, 0x0, 0x7, 0x2f, 0x0, @rand_addr=0x64010102, @local, {[@noop, @timestamp={0x44, 0x1c, 0xf5, 0x0, 0xe, [0x2, 0x5, 0x5, 0x1a48, 0x5, 0x100]}, @ssrr={0x89, 0x2f, 0x70, [@private=0xa010102, @empty, @multicast1, @multicast1, @empty, @multicast2, @empty, @empty, @local, @broadcast, @multicast2]}, @rr={0x7, 0x17, 0xf4, [@empty, @multicast1, @empty, @broadcast, @remote]}]}}}}}) sendmsg$nl_route(r3, &(0x7f00000006c0)={&(0x7f0000000140), 0xc, &(0x7f0000000680)={&(0x7f0000000c00)=ANY=[@ANYBLOB="78001200060026bd70006f7256855c8f5405e164c0a06d1cebfddbdf250000516664cba3408179557096d7dbac0000a3237d426c1c7177ff4ba7558bc80aedd52b1126f4dcc26e8d97b003900119a31ea5a406789bf62b5d0db99ad1323bfb07519e1c657f32ca02000000a969cd959c7d511fceafdf538a3c353c3566740ac673b063c452981e97c0acd42f16f11d1d8266ed29681d3186685efd6c3471bd6f255d00d25e3daa2b11f52191d4d06d30d62139c957643eeff008bdad78908497997f03d501ec5a73cff4280ca7562d78ae07cc0da184003e0a8bfd0862b50eddcfad66e3d1769530e9e88352f6c6b34b61189250e52f4d23c5a375fdda88f9551a9199be42d6c46cfdb2390a47219a44d41c780b89d712d92feaeba1fe5e89b39cbcd97f05464cc4b092d433cea430ca589018404f33501029f5698ea27816df32f2910b018712e7218c71af2877", @ANYRES32=r7, @ANYBLOB="040000008000030058011680600001800c00090004000000010000000c000400010000000900000014000b008200000000000000070000000000000014000a000000120000000000b6040000000000000c00030007000000090000001000060001000000ff7f000004000000200001801000020000000000120700007f0000000c0004000700000007000000540001801000020000080000f3000000030100000c00090008000000010000000c00050005000000010000001000020009000000b1000000050000000c0009008d000000060000000c00070007000000050000008000018014000a00ffffff7f000000007f00000000000000100006000100000005000000ca0000001000060006000000020000000900000014000a000180000000000000000040cd0000000014000a0001f0ffff00000000f7000000000000000c000700900000000200000014000a00fcffffff000000001000000000000000"], 0x178}, 0x1, 0x0, 0x0, 0x4002}, 0x48040) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4, 0x70bd2c}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r10) r11 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r10) sendmsg$NL802154_CMD_NEW_INTERFACE(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000a40)=ANY=[@ANYBLOB="1400000098df58ba77d3907c3e73fe63fda51c1577f2a2c288aaea9f74b4de7ec7a1f23da382558532c2bae7a320e3ee0294cc568fb8ddd400326223af2d170f628728304f4b58a208cd6f73eb0e9629460511868bc85ad95c5f5b11708c46b0db67868d08d1c323d761de43e914b0dace8626121650dd5d96a12287902009b9865f27f866c4eaf156d0bb6e34d0afacfa668c3d0ba3aab49d718dbcf79ffe44f59c2012e0fa73aa6253b90feb614c9e243012afed445a9611295cbd47e615ce67", @ANYRES16=r11, @ANYBLOB="010000000000000000001c000000"], 0x14}}, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="554b0000000000000000080001800600010000"], 0x28}}, 0x0) r12 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x14, 0x30, 0x53b, 0x70bd2a, 0x0, {0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$ipvs(0x0, r12) sendmsg$IPVS_CMD_GET_INFO(r13, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="010029bd7000fcdbdf250f000000080004000100008008000400530d0000"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4010) sendmsg$IPVS_CMD_SET_CONFIG(r8, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000900)=ANY=[@ANYRESDEC=0x0, @ANYRES64=r13, @ANYBLOB="020035040000fbdbdf250c00000008000600080000000c000180060004004e2400000800060008000000"], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x40) executing program 1: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f0000000b00)="9e17c2977a7873aee9") bpf$PROG_LOAD(0x5, &(0x7f0000001680)={0x1, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="b7000000f8000000bfa300000000000007030000f0ffffff620af0fff8ffffff71a4f0ff000000002d0a0200000000001d400200000000004704000001ed00007b030000000000001d440000000000007a0a00fe00ffffffc3030000e10000009f040000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d66a77ac8daab82167606068067500c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923030000000000000014e72ba7a54f0c33d39000d06a59ff616236fd9aa5b4e377184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049ef6a989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7592566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270fa3d0ee281eaa11ad47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42e54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65807ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91c11ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6cb5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cdb70f617af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028af0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00672f0814bf895e3a6dfbc711243f58a817895f5c4eaf7de8411a831ef65508f416ae3fd1db8386f6aae40515273adcff6196bb45476ec0a5279ed223f772aee25947b1f0d275c0e495b050f10a0b5d19b578a2b4096b9df527211bb39a29224c34a517dc344a195697b0c158d3519c04fe7621ebeef0bc369a1431a90c4117bdfe358e0e869e9f3e5443813261c1c3c78ab2584603e4468de7d0dc93691491050666f4ea5f083a1b281ed230569921856befe07538fbf33f43fa4ad583867bee301ae1e2566ae7a7afb7fc54895a2fef928d91a162affb4d373c7628a2871d7d19eaf06ed5f58f799c8ff391d3752b115073702ee257ade173dd2f736ed5939f219ba42f7650b9a262f6ee4af52aba3e669a835555ea1674f89d7f98ee1a1c7f977e0a93fdf91606d01c1a9dacfd4328502948bed0bc9514e4f66846bc1f245aa5abad88d56679092fee01007cade7ee72a49a498d51a26ba5cf0896cd9143d457262976f682bf31833ee99b5301f349dd2815e76a8b9a6cec5e000bd6bdafcb9536379b6cd0351cfe345abb1f1bce4d15a3f8b2bb447249a6cc5d201a"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000200), 0x8, 0x10, &(0x7f0000000000)={0x2, 0x40000, 0x1, 0xe}, 0xffffffffffffff7d, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2, @void, @value}, 0x15) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000180)=0x2, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x200, @private2, 0x5}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x9, &(0x7f0000001a00)=0x1, 0x4) sendto$inet6(r1, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) r2 = socket$inet(0x2, 0xa, 0xa22) setsockopt$inet_mreqn(r2, 0x0, 0x23, 0x0, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0xffffffc1) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = socket$unix(0x1, 0xfd407b1c7cc76f1b, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x400448de, &(0x7f00000000c0)={0x4, 0x8000, "e30022"}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000040)="05000000010000", 0x7) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r6 = epoll_create(0x800) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r3, &(0x7f00000001c0)={0x10}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000140)='contention_end\x00', r3, 0x0, 0x4}, 0x18) close(r4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='contention_end\x00', r1}, 0x10) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) getsockopt$inet6_tcp_buf(r3, 0x6, 0x1a, 0x0, &(0x7f00000001c0)) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001480)={0x14e8, 0x2b, 0x1, 0x0, 0x0, "", [@nested={0x14d8, 0x4, 0x0, 0x1, [@nested={0x13e0, 0x128, 0x0, 0x1, [@nested={0x1c8, 0x16, 0x0, 0x1, [@generic="a853c9b8abcaf8170bdb47e4629fc3268596303ed2c6b8296f239889391b18dfdcfca64bd04a34bb0a63a7042959100da17c2ccd422cab9f593dc6159a179957783ec1a03e590d77a949200970f35372cd9648314a4938a89e06afe7235c4d166686db14ebf9779c16a76a42f9ec292df0d99c0734f843551096e3b1f73b52b82e9990c312777186ba52af78f4cbfdce6d17224aa8f79ea52af292e4c2a495a24b5cbaaed76c978e67174e3f6f30587fb88bd0bf", @nested={0x4, 0x5c}, @nested={0x4, 0xad}, @generic="265a0a4b0285246634b2d158744a61fad62b3221c539dce88c5260d51237ffe80a67bdd5d070234c1a736e4994fafcfd77a0b89e4edbfc23060ad4a2aae01cf8e5076d5f48ccd6879166dfc05a95308898ca3512b2f94634454bf6a9ea79da9541484df8a2e7c2fffa5fbe095cc4ae6f2a4c1c2fba2368afb1f1187662bec18722d278dac036fe8e197c1a2d8b81f9060831fa1241cd895d88509d31c02443a4b9bf891d9915e552d49343974a97a411650f360399eac84df45a177b0e920fa6e75cbf14d7cf2161c1984361157cb0161cfe6330b34fcbff92adb1d574ed75349338175f62eadd68da3b41a27d37e509", @nested={0x4, 0x23}, @typed={0x8, 0xd7, 0x0, 0x0, @pid=r2}, @nested={0x4, 0x80}, @nested={0x4, 0x30}, @nested={0x4, 0x3c}]}, @nested={0x5c, 0xa1, 0x0, 0x1, [@nested={0x4, 0x147}, @nested={0x4, 0x26}, @typed={0xd, 0xeb, 0x0, 0x0, @binary="03957bb9c8d9de7a49"}, @nested={0x4, 0x5d}, @typed={0x13, 0x29, 0x0, 0x0, @str='contention_end\x00'}, @typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @typed={0xc, 0xa7, 0x0, 0x0, @u64=0x5}, @nested={0x4, 0xd8}, @nested={0x4, 0x12b}]}, @nested={0x53, 0x23, 0x0, 0x1, [@generic="2c26403fd5fed6780d7a6f39428c821feda3698ecbf979e49a14383b4cb7855c11d281", @nested={0x4, 0x136}, @nested={0x4, 0x137}, @typed={0xe, 0xcc, 0x0, 0x0, @str='syzkaller\x00'}, @typed={0x4, 0xf5}, @typed={0x8, 0x131, 0x0, 0x0, @pid}, @typed={0x8, 0x4b, 0x0, 0x0, @u32=0x2}]}, @generic="5007e2d17299b2339b67c16a31004deeab47d6790110f3bca701eeaec10afcf586ab5883fe01a9973bf18fe8dc8edb10dd625479455bb903e032262bd1cefb99bc7d476d240bb2e7d78aaa4f0948977b4e43e41ab037c2997a00742f67f2e28aa5f87c63fe40698988b4e59b0c5bab3a", @generic, @generic="3f6e86e5e08f4599fa6bedbeec4a3ea26bd69816dee6100a171403ab4ff8b9199535d50727f78966ce0e7b25f5d563a00dc602412265d66c0cdcc800ca910bc738b220c9aa6a230d9c81b1d196e169482cb7f5e95b8d5fe523014a08de71dcd22b07667e9b08e78cd6fd226b26ce3721fe480f27fbe3430c6d9abfe0f4dad6999d2a6d5eb91f004fbedd730b1d397afaee", @generic="feca4d8690c2491a0c086f25f27a2bce0cc898f4de62f28269b45923edb4fb9b91bc6978d29af2b0434766d348b00f620f69761b5071760d4df6cb0ef62c4e46216cd48fadfd5592091c313ffe602a8122d7a50946ee2b6d3aa90be7b95d52", @typed={0x4, 0xd1}, @generic="309f64e5392584b66624919d4f257a3e4865f6e3597a3abb2a59ad497cd17add4b84d4ab3d611216ee267385be0f179d8e597f7edb3df214ef238cf3e28d665258d4259736553927bd642e918c1e9850503a08ca4cec42aef309921c7893e4ebe1f041b427472e70481d47daa8a315e1edd54a730ef6eac6d5b499309ae3e2245f362ffb91c9ab91629e7973d51500433e2f71e95c7e0e453e62cc4626897607a768dfbcc1f2b95e37ca5ba76a10549b7136891967336cc2565a005167151d312ec7b515c27efb946f7d82a6633e8ff321bcaa1ba952770d94b74faaa7511714bb504d9700fd0538637bb5e4739ac8ecec54d7f3f8f13601e73cb9fea4615e4025b331b4079d3f6480c35df1f2db641c060c2e3ff61787d92fac7f4aa13058a1691a33f17c16f882294f655f31535c252d54cc6c278ca5f6319e5e351e38108ccdf54b620980356e77ee64f67d6b424cee642fd0d2db34d8cfc7f66d00120379e095d303363aab2ef831acfdf211a9c3d2f2fa59c82bf37d690137dd0f7daa3cd8763b18828a1cdf9b3955a7f79d25048935a33bd75aca76236d65b226f5dfabae613d0e6a0e50a527a7abf8fd1c73d295064e03bd0bfa97d0139d87aed18ef0a359c260168a9f93908d7cff99763c181571d423b0815ff06f46171fd1d09c4813210b69f91d5d95470fb13dba7bb116de09d7de594a181240d2a1a85e9f68d4b48549b555eb739fb5405fa7b29ffcf0fd8e2b034ef94d82ace797a6a2023e73857c287fb16d24d4cffbbb7677ef76790e3daae1eed2a8029e5b8f63c05bd57efdd35e135b52f9e09f3c85179270af01b2840762f5157dfacabf4904690a8a73ec524968f657919bfd606545927a514cded6792c7e71f6d688a67b28cf6deff447a69e38bbda42e1a4dc86f5ec271b399558f51756749f0b03282c38355ef07dd9afcdda91118287da51fff2d0be462fe5b62c8afbadbc43aeb9c3238be20754c2d7ba754aeb7c43b517ee452bc3b27bc5edccd157005075472abe17e27c9b9b4e446d65ec5b12c28ee9b9ec35d114da78850a68e807629bf71355d8c73183587ebdc598d013a94fdd9c790cb8b33ada0a3e9eb0e9c2adc9fab692c7bccfd12ab8b3a4ed824a8ebdff2e8efae531f55f2f3098d2d1297bb98c1fa562c88e0332c95bd5aadef40b0b7e533f02fd8848c2d2d4c656049153e01d593b2978f1b1d4b5e4380e00357afebe28b13cdfcd26907f1a913f807e31c1487dab0675ea1cba6612c8f64276f31f25ed06ac7c2b931c481412c5c460d1737f0212a52efcb3e82ee1baff978ce217f9671faaa478aadee10880a0b5c6ea514fd0beff04d33727c5b8ba62c5a6dcb5745ab6b63534a5d947bd3083a13e69e645ecf5fdc3d6008bf201064e5c73e0ebae9dd2b5b4078125d0f28044c0b7d1362ff49be0e2147cc23cb694757638ac8943a20b53f43a03185eccc083a4cbaa79627a2428dd46a3dd33cd9fb53a89553e5777b52c3ef8e8e69c8cd6546fe23afd03164d5fcb827a09813b9991ef2fbec2c83d5d5fde79a5e23ba03a2ff4f6064bde20fc9da1665cfd471b8a1c41783109217c01eec975e1af63e0e887084db726e556ce533e1d41ac0da89943ada45301bc03f422f5ec632af810f3b7c8eb79927ab551c70851aa90efa6276d17be4071b0051aa516ddfe666c3644b0151487add6436b88b52eeb97302b7176f74661e7b2b416517a552016fd3ee538d4bb7d645cf08386242429ec7fe5f5eb5ee31f0dc3cbe2e125de0f96e3e8185cc3fb7ee314dbd50713a4855ad49ecc1255423fac872fe66c9f2943627969419022337c5b4307c69635fb8fc5ef19420b6f210f609150bf4feb90c269cbff9ff6b68afe9d69158e97a8d994372a09f2c2b081a4c9e7bd038231df5df38f8ca3819852cbb5d51e16249061d1239f01390b429d46e3e8582cb450db40673ce6cc73deef412bc0b444bdbd9a9f996208ce6ad1960bb7547451b485347d71dca57a6b6c285edf206266bcb1f91e2d86cdbbd2abd3f7f7e6b9b74f4f50137d65b6fd2bfe6b9f5dcbeb2f9396c8b2b34aa54544e58f1345d5877f4b56dbbe6bb1c26bf1f42908aa655dbb8c3c97108629c53428afc8dba252639cffb1b841720192aaba4b2f579f10d57110ded8c63e779ee8afe8a612774a3385797fbe836762553e81d840938e7d462feb40d750081a33cb0636fee9f1b6fabdfbcbdbd4d6831f9de349d807544d864e8225eb1bb56ad14efb699676ad3a3bca439f29fe6529ab4eb27a81b7d4be829de597aea299aa23011aba45dc0e57e1710a5f947a30f06085ddd6ed17a95d0c800afbf4b97334db9b06fc342e99a375e082b6a5803c26385d3d4c0c940ecea2d41c36ff3efeac76366a9a2aea261d7dc1443556db5acec0fdafc9b11fd518e25759b5ab4e5b99efd23fa43075c0daccd9f80878771694322c4d929db6f99ca4dbbe699887cb134b051896472ac4ad5980b078a0c108971d7cfc13295a5557a42aa5515c4931192800c2788ca107a42a7b87eedd3e3374bb4ffdc46f53e9bab6bb3ba76b55b392d4cb36c83a2845439398a94160ed4d47006ca0c2b36345e13980e220f5c854bb780bfbc768e6ca202f6873613581ff9e832e12f6e7798a880f42dee72583d303f6bda3f4b92e3f03a5ef3c0eda101b02ebb3244d36a01f151e78a705ee5a694a336bf4ffe54da9fa1d5c6c9abe5d8473d3d25191fbd197ae310d895b4addab4518fb0dbff1d67bcbd12505fc93f3cd8a50f8cfbc66e0c04433a252a6077a7a5b07cc3f4d0f95082e4597a834f6138a416563b02ee55b35751e8a9792a811d91e639dfee39d540b6ded5960f3e70964718db77240f4274a26131632aa97cd48d652f028d00a21400f0ff37af664d9aee71654ff2d17ea6cf2d3bd124fa09189d9b900358dd8b529713a02121666d60776fec6c05fd0e48da3ff20d44151e717137b281b689d56b5a97e38329a6267c9e76632572a1e08f7a09140474c2873f99e863316b8095fc4be0e88c29d6b8ce628417796e48748ab8632902f135ee32b4fcef1ea223628561ad31a4482dac5dd89e716b5cd06399a2f48a08158b673c855c2cf3be808a80cd27975adb25aaf065793ca758f77c595fe69b7bcb39e2d9df18c6bb215997438a2b63e01e720386bdbe0e5a22c64b8f314ae4f929dee694765dd6c60e55c7fffab55a1403d13e437127ba1e90b78ac22ae410a8f6031e5b6daa8f7529c2b1b44c8e8584c8885f19c09d302b9d9efe039236768a92544c0729eb955f82fa3d8c539cccbc68ac6b725bb060792d344d151ce4cf96caa9e32e9537b175c088a9592e724af9975035a7e3490783b44c3f3ae59d423898fe39380f1e729abe3cc25ac211c182e248b5ce8b4ed83f8860cf31a7b7a49302df21e1fbbf47840d10ccd8b3f1edcd29001ac2a2bbb6fb39e857c098f9ab63a394a2f815694e2de1eb3d159c998bc02b6dab5114c83d4c5236293311c15585cd2362db3fc1437be2fbdb7c83aeda6c597c4ba2f88a5b0b8e9b5b88a561a5d43f0418a829e47d5e488790db211701bea51fb72dc1b372efe5cb7f42d31b8dffc8b1abe2a500e8960dbe1f477f4d347062253ff7007d278b4b87deb5f786a3bfe5303004da3d5124fc96ff70e7eba109d9f39ce01d8026a84de8bd94de4c3645e6e9ca0d5895804eb30274f3f3e27adec53b403a3770aed58512fd4bca5fd565a30434b30d124b84846650303be4d4e19ee68927b9746e756c3ce381880df2e68cfb51435a2b52311d03b3564547d8c609604fa941d81b5d711b699718a5ff31e247718c0a653d7d751f53b2687c8cd509da11316e789eb0dfc26ab72eb0adf082a2ad354987f9a8ccf8326513fa5d8f5c85e1d56f474ab1b4677693dfbcb1dba247bef09fe7a8fd3ef110cd35e705fe01eb51f1369b5fca2ebc2133dfbb1f273a1c4c3c89fea73170604c3c6a7a66692563b2116bd1a8418d8a076f2e1ab90fba450f1f0fc72858d4d2db58e16b66b221e8c6fdb2e89783fb382620cbdce4dad8b098134de456250e15d8a84a38504a17252d4b3512a420f63dc4afd8149b70d1e386add4c6e5d8a836c749da4fe4adfdf22df5503d3de9237269f276a27f7745daedb3134ed3e16fa9b9472e54ca5b82f87dad03ba947f655a28d04b14ee937ffc9ed4d1035debe61a64881953af868217ef54d501e8f1c9a44a495faaa525c34312205fe1034cfd921d3cc8e03390394861288421b772198c29da2cb88d505e8e67dd94b6db57c271402a95bd89dadbbd1a51ac46d2e2e586c1b9c6e14ab982a4d3676a84c931a56bc1cddd5b8b3a84d56d6104c73b097799a35e0dcff0338c984ee1d2bf5d9b3d68f69b1e0877128bf5f807a96ad2b6e4306b80ca873fa5c64a80e0d22046e01b8c135737dd8b99ea8fee69c6b0d43be07d58bbb3d838290bc317c24c2da8b1df157543ed1c84fd9611ea972afc42315076fcced07e0fc9ee2df70832a1522a8012f351ee17ac597ad2bb0b4339f711da2d3e9783549ab1455cf5c64294094771ea4e1cc2c5e3a3deb026c6458fe8d2fed3663ee7fec9529ac6caec6720866d5829e4762e348c440c5c7acb94be667f79e123a53acbc6c09b8a8bcb43d652d485cce26f22058e96c0ae27b9b5a0044c633c1868d094ff6c124d4914b6e9c457f249493a3643b65493a3e641eff935a9040012f07e7b4c1ded220ab6e8fe7007f1aa0ec7585b4f4cb96e6dbe392d611202a40cd647cfe4195a3af687ef525801b804fd9167d0753181184bc78c31ea659c4ccfe31256f4c5a636cc68587df244ac3cb9b3261a315d8cbdd473a3f46f263be684a35e962c4f42a530fa6e435517043bdfde2a373031b2a51bb9f0ca354d62b643bf2ec2f2850a12e5f8ef996ef527a2c588dfe3aea1d672983ad8e6c50f75368a26215e36c597555dfb9d3b588109c62d307ecc9cb744c8bc1b19a509b9efc21c5b28adabd21efa1f8e0a789fc629332841fa052759b909378f85d855c82eaead3d8400a8fe835f7308bd038bea66d7b431cc801b818401a21e169fdb8e0c4c8298d4eb7989a7a5c43632f346333b114cebd0b21b85564e5a9ed8a07089841b742b7fe5abaddb114bf2650475338342de9283d19abfd6649ca2dec2354d9879ceb472b29a07e6648fa64c45739fd15e0a9d4e9d91899b1397c13f938769de4f9ab773164dcde5dbafb723018fac9f3271a2abd5a8a8453aacda5530fa39477fbcaa6569dcf67c3385fdda37aa40d9761d8b9cba5cdd04f87cbcb9c3c54f62705e8951080caa74ee44d4588198a424fa7a7742b64bdce771fc88f7df6cb9080694fdbe8e867ae54bc0fecc7bdf99dcd313fa72d4f726a4d9f552c7f18a69f367dabba684b66ca6aecf7a238f1fc7a27ccb6ff377b477aeaa25c888a5d68acddd06ac2085d2b6484eee193ead0d33a7e0c2b0cd612f85d6226168e49972c0146eb677b7a772a71fd2199e653b850646768a96210e7c6c4c02daf1a27950d86fababbf27834dbd0d1f89438c932a3786d1a3f50839072dbbccb66f9f81ee77aff44e89189abb7ebba5ca80cfaf9b8903ed06e302b263073c4389e8d4841382409c08c9628fef02d33bb28c3cbd42a24e3501147aeaab6e0eb80b123fc4ad468d99692fd2817ff303d160d53aac18718c2c3384a3925599684951e8c8c7b7d48aa99dd90d6ef59e72287c6acc4ce670e4e7d4bf24eeb0391000f5b1b8f1c93250109242cd655a01398ad2e4e"]}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@loopback}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8cd1"]}]}, 0x14e8}], 0x1, 0x0, 0x0, 0x11}, 0x0) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) accept$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x3c, r3, 0x1, 0x0, 0x0, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400d5}, 0x0) close(0xffffffffffffffff) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r1, &(0x7f0000004b80)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="82", 0x1}, {&(0x7f00000000c0)="8484", 0x2}], 0x2}}], 0x1, 0x4400c800) sendto$inet6(r1, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102000000000000000000000000ebf5622b060676179bf02a5ca21c9181166a3e561614e54b27d2d16a66c28a808c576265bf5f436e151a08954809c2722084ed8ecfed53615b50bdf78b4a1f5f030efadd9729a5e08439786be6f3ab759e1813b9e146f3a092a05cce"], 0x14}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001640)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x4}}, 0x9c}}, 0x0) recvmmsg(r0, &(0x7f000000c2c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x3a, 0x9, 0x0, 0x0, {0x1}, [@nested={0xc, 0xe0, 0x0, 0x1, [@typed={0x8, 0x5, 0x0, 0x0, @u32=0xf}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0xb0, 0x0, 0x0, @str='!\x00'}]}, @typed={0x8, 0x2, 0x0, 0x0, @ipv4=@broadcast}]}, 0x34}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x23b, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000001200)=[@in6={0xa, 0x4e22, 0x8, @loopback, 0x6}]}, &(0x7f00000011c0)=0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x40, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x93}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x40}}, 0x0) getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000000080)=""/4076, &(0x7f0000000040)=0xfec) socket$key(0xf, 0x3, 0x2) executing program 0: r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x1, 0x0, @void, @value, @void, @value}, 0x50) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r1, &(0x7f00000011c0)="a0", 0x1, 0x4495, &(0x7f00000012c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) shutdown(r1, 0x1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="00000000000000000094000000000000000000000000005fc273680000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x100000, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socket(0x10, 0x80002, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MAX_AGE={0x8, 0x31}]}}}]}, 0x3c}, 0x1, 0xba01}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000007c0), 0xffffffffffffffff) unshare(0x2040400) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000020000000000000000000000850000000f000000850000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r5 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000100100000c000000fa000000000000ff"], 0x18}, 0x40) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f00000001c0)='netfs_rreq_ref\x00', r4}, 0x18) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={r6, 0x0, 0x0}, 0x10) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010027bd7000fcdbdf250f000000063e4961f47cc83e3f3b310000da9d68145b18b8eb452fbd"], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x810) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x2}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) r10 = socket(0x10, 0x3, 0x0) sendmmsg(r10, &(0x7f0000000000), 0x400000000000235, 0x0) executing program 1: socket$inet_smc(0x2b, 0x1, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@multicast, @random="777de85bf4dd", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x8, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_rs}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0xa}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x80, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100e}, @CTA_SEQ_ADJ_REPLY={0x14, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0xe6ba7615268e7f7}]}]}, 0x80}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000300000000000000000100736974001400028008000200ac1e010106000d00ff030000"], 0x40}, 0x1, 0xba01}, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_REMOVE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xac, r3, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xad}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xe0}, @MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x4}, 0x40000) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x1, 0x4, 0x6, 0x3, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\v\x00'/20, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000008c0), &(0x7f0000000b80), 0x2000005, r2}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000340)={r0, &(0x7f0000000640)="87aa0abecf670dceba8f350bf354a5e0dc3faed171d650d741014e148c5b232b6e1b0a6cb160fd117e77447c6de84edd4ef9e41d73cb1ece6b51cb5a6381f90383a1a778718f551a88a06bb3cc44ddf3e081243a0fb4a4696ae33bc125b05f20b4154cf5f9a52d87d4e5dc09d42c2aad5b30703f02e636f48b70d0b2046d64ae5e3a56e7dd95186f098e233dae9c6acc796677d1b4622d6fe67176b654b5ec5e905f50fc31bf0b051dfb7a26a93fa4172112cf67398c0de89d03b804f0adc5a51cd3ef7defa1c197844981daad026a9840606884252ab4105b31ac1f893cfafc1fea6cdcc1848fdd5e8b57d367", &(0x7f0000000740)=""/156}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000a80)=ANY=[@ANYBLOB="1800000000000000000000001000000018150000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005500000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x30e8, 0x3, 0xfffffff9, 0x4080, r3, 0x7, '\x00', r4, 0xffffffffffffffff, 0x1, 0x0, 0x1, 0xd, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000000), 0xcff5, r5}, 0x38) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r6, 0x84, 0x74, &(0x7f00000000c0)={r7, 0x0, 0x10, 0x6, 0xb1aa}, &(0x7f0000000040)=0x18) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000240)={0x0, &(0x7f0000000040)=""/141, &(0x7f0000000500), &(0x7f0000000280), 0x4, r5}, 0x38) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x74, r10, 0x0, 0x11203}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x5, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x10) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x8001, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socket$nl_xfrm(0x10, 0x3, 0x6) r11 = socket$rds(0x15, 0x5, 0x0) bind$rds(r11, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r11, &(0x7f0000001e40)={&(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@rdma_args={0x48, 0x114, 0x1, {{}, {&(0x7f00000014c0)=""/54, 0x36}, &(0x7f0000001540)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1}}, @rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f0000001a00)=[{&(0x7f0000001680)=""/82, 0x52}], 0x1}}], 0x90}, 0x0) r12 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r12, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r12, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r12, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000140)="03", 0x1}], 0x1}}], 0x1, 0x34000811) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r12, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYRES16, @ANYRES32=r12], 0x1000f) executing program 2: r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000580)="fc457c43aa3f7d64673331496d0983b8be420782d9ac4b57e91f62b9dda712d2ef95adf34bc11e0e33b7a5c2842e81cb", 0x30}], 0x1}}, {{&(0x7f0000000780)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10, 0x0, 0x0, &(0x7f0000000840)=ANY=[], 0x18}}], 0x2, 0x0) executing program 3: r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000800)={0x100, r0, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 32) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000020000000000000001000013070000000000000100"/50], 0x0, 0x32, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) (rerun: 32) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) (async, rerun: 32) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffd51, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async, rerun: 32) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) write$cgroup_int(r5, &(0x7f0000000080)=0x8, 0x12) (async, rerun: 64) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="b800000019000100000000000000000000000000000000000000000000000000e000000100000000000000000000000000000081000000000200000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000001"], 0xb8}}, 0x0) (async, rerun: 64) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) sendto(r1, &(0x7f0000000700)="9ab5808857d89c02fb45b512a3e405c6a18df8d13e5cf79d358fffe8a74dfd3756756c4fe8b50d3d96d0f9fa2059f757f3fb9090e0baec4219f1e878f050ffea02cb5f22934621245b9c587a8fe9ae5621d69347763fd81fafa83effdfb5b20c837d4f43ee97ed4ad995b2c03a90e528cc72156df5b7011d5dc7eb9b7cb3572510eb2fce21f1afc000da068a1f27ef4f8667bb6feae9fa6d5c59f3640c51385d818a97c6dce72528a17c83920d3d5a194d8c055e5622100819b50fe0740c2cbbd77139520f776b561443685167d9ca17c0514fdec1df9d5b9708c6db71c861f9fbe708c3946118c89794ffa11aff077ec950d7", 0xf3, 0x804, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000002c0)=0x6003, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080)=[@window, @mss, @sack_perm, @window, @sack_perm, @timestamp, @timestamp, @timestamp], 0x8) (async) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) (async) r6 = socket$inet(0x2, 0x2, 0x1) (async) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r7, &(0x7f0000000100)={0x18, 0x0, {0x2, @local, 'wg0\x00'}}, 0x1e) sendmsg(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)="5500000018007f5f00fe01b2a4a2809302060000ff41fd01040400000a0012000200", 0x22}, {0x0}], 0x2, 0x0, 0x0, 0x7a000000}, 0x0) (async) r8 = socket$kcm(0x21, 0x2, 0x2) (async) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000940)={0x0, 0xe, &(0x7f0000000000)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe55a10a0015400100142603600e1208000b0000000401a80016000800014009001100036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) sendmsg$kcm(r8, &(0x7f0000000080)={&(0x7f0000000000)=@generic={0x25, "4bc475336c5858aa36d22e2605dd52416ad64dea6679d6760eb3ae06eeecab8fb38f5dba7f566ef424bcfc034322e5179b4783cd9ede9144e15085deeab643ea8a8f0048f0be4c32ec727eba69e206dbe9dea8b7cf46938ee7feab499bd8db55f5c530e2d55a128d603119be1625aca347038b73ee81502998f370791659"}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYRES16=r4], 0x18}, 0x8000000) (async, rerun: 32) close(r8) (async, rerun: 32) sendmsg$inet(r6, &(0x7f0000000600)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000002100)="0800a9fc0da6b30a", 0x8}], 0x1, &(0x7f0000001d00)=ANY=[@ANYBLOB="18000000000000000000000002"], 0x30}, 0x0) (async) sendmmsg$inet(r1, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000200)="27fe6da9b9cebbb18bafd9ccd79f0efca7a903c7a6fb41ecbd409f1a3db49cc612de34d4e9a8af95005aee32dbf7b63362533b67d254932beb05349e93971a53b856ce30901dc6d5679605b1dfde5241ca7183a9232bcb8c29e4fa570f53f09a5c34fd7e046ae08a1231a6f5654f2a870ccb697f41bf7a60a68033e80ed7dc6c7c06deecaaf2fbbd4e2bea22582fa90d8d14aa07b40e9c3415afb5", 0x9b}, {&(0x7f0000000100)="ac04048ea155344276", 0x9}, {&(0x7f0000000140)="a3dab3a1efd701da2d9607fa7ae104fe4e788344012ee808a9760da3249ac6", 0x1f}, {&(0x7f0000000300)="f1374fb8259ce1fcd099ef0a9ce716aa1c8be4e98a99f15b8069b924e58f605e96f1e947ecab1f70a511d0868f949bd4f8efe41209d6e6ae2413862ce802da43f9f1520ebded89d4947eb2685f780aa5db2a3728c288", 0x56}, {&(0x7f0000000380)="a58df42e976cc6e43303b58c453196fd57f61c89e96c0ac0ad0c4c19a1b80b2e78bf8fc8a904310f90732a6c316473c27706680d7dbadd7fbeb2a98436b22b99174eb9a36e84e56ddfa1e59ca6b03bcc32c508715075ed74ed334214928bac4f19ffe2a8f6bdef50f19499bd2b31f380b7948507479bd6170e98c4106a5c0edf30fa5e08fdfdb9571231fd07a95edf125df4433624b9e2df35f8d92ceb09a9fbf78fa03e044a99a8c9f4e524cd1ac5148a20575ba9f60acc4459ae3b5d84366dee82a25d7884711d9f7586cafb21b4ac5ce5eb48e31d352deb0e5474dc11", 0xde}, {&(0x7f0000000480)="bfdf8f623b14d1b0d12a6c9decb13220b9ee0af979d90e2ef5aa0ebcbc792d3411da", 0x22}], 0x6}}], 0x1, 0x4008095) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006b00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000200), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x5, 0x413, 0x0, {}, {}, {0x0, 0x0, 0x1}, 0x1, @can={{}, 0x7, 0x7, 0x0, 0x0, "94b1c39a3cc2fbfd"}}, 0x48}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x24, 0x3c, 0x9, 0x0, 0x0, {0x2}, [@typed={0x4, 0x200}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x3, 0x0, 0x0, @uid}]}]}, 0x24}}, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2a, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @val, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x60}}, 0x0) (async) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2a, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @val, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x60}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000000)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="cf0400000000000000001300000008000300", @ANYRES32=r6, @ANYBLOB="0500130092848b000a00060008021100000100000600100080050000060012"], 0x40}, 0x1, 0x0, 0x0, 0xc0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r8, 0x5, 0x3, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0xb4) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000001c40)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2ed0300000000000000af99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14008c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000006da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c4159b364a4fd7013f34db173a4fdacf15229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4978ea8e4aa37014191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be867a28f09c5877fc2355ecdc9c30dcb2d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff3a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb357b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50265a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d9a0e06da200481cde8bf475bc3e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a00"/3590], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x2e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (async) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r11, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000380)=r10}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x8}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r12}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x3a}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) socket$alg(0x26, 0x5, 0x0) (async) r13 = socket$alg(0x26, 0x5, 0x0) bind$alg(r13, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-ssse3\x00'}, 0x58) r14 = accept4(r13, 0x0, 0x0, 0x0) sendmsg$unix(r14, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)="1709f53e25f27116776b40cd3c550d298dd1b9266c15c25b83f011b965bb18efe36db9195a46d7dd34", 0x29}, {&(0x7f0000000240)="8bd751665b27b5ee408c629bceca8e7af4e15e0c93db7c7cf5b0d8bdaf6d95e8f449260f9dd2f4b86bca6d5bc7951cb16b4c5e340be7b089af5481907baf4c757bc0ff04cea7", 0x46}], 0x2}, 0x0) (async) sendmsg$unix(r14, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)="1709f53e25f27116776b40cd3c550d298dd1b9266c15c25b83f011b965bb18efe36db9195a46d7dd34", 0x29}, {&(0x7f0000000240)="8bd751665b27b5ee408c629bceca8e7af4e15e0c93db7c7cf5b0d8bdaf6d95e8f449260f9dd2f4b86bca6d5bc7951cb16b4c5e340be7b089af5481907baf4c757bc0ff04cea7", 0x46}], 0x2}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r9}, 0xa) r15 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r15, 0x8916, &(0x7f0000000200)={'veth1_to_batadv\x00', {0x2, 0x4e21, @broadcast}}) r16 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r16, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r16, &(0x7f0000000340)="24000000010001", 0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7a}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) executing program 3: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0xc, @broadcast, 'veth1_to_team\x00'}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x101a40, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f00000000c0)=0x1) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x2) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000000100)) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0xfec2, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6gre0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc890}, 0x20000000) socket$pppoe(0x18, 0x1, 0x0) (async) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0xc, @broadcast, 'veth1_to_team\x00'}}, 0x1e) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x101a40, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0) (async) socket$pppoe(0x18, 0x1, 0x0) (async) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f00000000c0)=0x1) (async) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x2) (async) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000000100)) (async) socket$nl_rdma(0x10, 0x3, 0x14) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0xfec2, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6gre0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc890}, 0x20000000) (async) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newlink={0x48, 0x10, 0x439, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2404}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}]}, 0x48}}, 0x4050) socket$inet6(0xa, 0x3, 0xffffffff) executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x4ca31, 0xffffffffffffffff, 0x0) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2711, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtaction={0x64, 0x30, 0x9, 0x0, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x1, 0x10000, 0x10000000, 0x1, 0x5}, 0x4}}]}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x64}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'syztnl0\x00', 0x0, 0x29, 0xfa, 0xfd, 0xfffffffc, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, 0x7800, 0x80, 0x4b0c, 0x3ba}}) sendmsg$nl_route(r2, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40020000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@bridge_getlink={0x34, 0x12, 0x20, 0x70bd27, 0x25dfdbfc, {0x7, 0x0, 0x0, r3, 0x20831, 0x804}, [@IFLA_MTU={0x8, 0x4, 0x6c}, @IFLA_LINKMODE={0x5, 0x11, 0xb}, @IFLA_IFALIASn={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x44000) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r1}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x11, &(0x7f0000000840)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x75}, @snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000000c0)='tlb_flush\x00', r4}, 0x10) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) (async) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r2 = socket(0x15, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x2715, 0x0, &(0x7f0000000000)) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) (async) r3 = socket$tipc(0x1e, 0x5, 0x0) syz_emit_ethernet(0x8e, &(0x7f0000000380)={@local, @remote, @val={@void, {0x8100, 0x2, 0x1}}, {@llc={0x4, {@snap={0xaa, 0xaa, "a6", "1e63b1", 0x17, "854a2c9eb0e75f511eee29e2d3bdc698f953ffe476ddeb16c495930520120e52a6564849a2b01c197f80b34bd352951c14417c7c195be632824bac5890209b590a32c05a809905bafe6182e2ca2fed36074e8ff21d8265bd8071998870732631558773ec9bd63c8cdd1065ae500811642ed42abe"}}}}}, &(0x7f0000000240)={0x1, 0x1, [0x349, 0x5fd, 0x1c0, 0x563]}) (async) bind$tipc(r3, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) openat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x2a813, r4, 0x0) (async) preadv(r4, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x22, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) (async) ioctl$sock_inet6_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000040)) (async) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r7, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) bind$xdp(r7, &(0x7f0000000100)={0x2c, 0x9, r6}, 0x10) (async) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r8, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0xa4}, {0x6}]}, 0x10) (async) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x42, 0x1}, 0x10) sendmsg$tipc(r0, &(0x7f00000006c0)={&(0x7f0000000540)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x10000000}}, 0x10, 0x0}, 0x0) executing program 3: r0 = socket(0x2a, 0x3, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r1, 0x29, 0x4c, &(0x7f0000000540)=ANY=[], 0x60) sendto$inet6(r0, &(0x7f0000000080)="7800000018002507b9409b14ffff00000202be04020506050e130204430009003f0020480a0000000d0085a168d0bf46d32345653600648d27000b000a00000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a3200040016000b000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r2, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x854}, 0x1) sendto$inet6(r0, &(0x7f00000001c0)="020ff3c63a9fae7a920057af134180ea10fb88e703ae6c10ad7b3106544060587d87aba5c8fb2bfcaa68ea68cbc8c820d42da8c13a4040e9485b54bffdcabc88ba33fcd13806c9fcc0645ee4a730cc89dd039f8e70fda358d11ab43cac3fd9340a497c0c2819b37c77e7845a406b485ffbcb6899a864d36ec06be2bcaccfe9797cfb3af4b22d0c0afedb56dcf802b703bdba96fe69abffe300cc76c8a55735024fc7f662e5d1845abefbcc98f34c041d023f211c5f659c5e7401a09a58f64cd30ef2c79001582f7ab3e0db06984b976383", 0xd1, 0x80805, &(0x7f00000002c0)={0xa, 0x4e23, 0x7, @empty, 0x6}, 0x1c) executing program 2: r0 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) (async) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) (async) socketpair(0x28, 0x4, 0x233f, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000080)=0x14) executing program 0: r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3c0, 0x0, 0xe8, 0xe8, 0x2d8, 0x2d8, 0x2d8, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x20, '\x00', 0x0, 0x2d8}}, {{@uncond, 0xc0, 0x100, 0x0, {0x0, 0x1e03}}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "2c3bb27d9d5b379b853c7744b526e29755ec721db80fdb00f95f8a608b8d"}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'netpci0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410) bpf$PROG_LOAD(0x5, &(0x7f0000001780)={0x17, 0xf, &(0x7f0000000240)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x5}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @cgroup_sysctl, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) executing program 3: r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{&(0x7f0000000300)={0x2, 0x4e24, @remote}, 0x10, 0x0}}, {{&(0x7f0000000780)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10, 0x0, 0x0, &(0x7f0000000840)=ANY=[], 0x18}}], 0x2, 0x0) executing program 4: r0 = gettid() r1 = syz_open_procfs$namespace(r0, &(0x7f0000000000)) (async, rerun: 32) r2 = socket(0x2a, 0x2, 0x0) (async, rerun: 32) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x4}}}]}, @NFTA_RULE_COMPAT={0x4}]}], {0x14}}, 0x58}}, 0x0) (async, rerun: 64) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000000000000000000000b00000008000300000000000c00018008000000", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) (async, rerun: 64) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="140100001f000504000000000000000004"], 0x114}], 0x1}, 0x0) (async, rerun: 64) getsockname$packet(r2, 0x0, &(0x7f0000001480)) (rerun: 64) socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x801) socket$netlink(0x10, 0x3, 0x0) mkdirat$cgroup(r1, &(0x7f0000000000)='syz0\x00', 0x1ff) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, &(0x7f0000000000)=ANY=[@ANYRES8=r3], &(0x7f0000000480)='GPL\x00', 0x8000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) executing program 2: bind$rds(0xffffffffffffffff, 0x0, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@ipv4_newrule={0x1c, 0x20, 0x301}, 0x1c}}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r3) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)={0x58, r4, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xfeffffff}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}]}, 0x58}}, 0x0) executing program 3: connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @multicast1}, 0x10) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r0) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000140)=r0, 0x4) (async) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xa0}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000840}, 0x10) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000280)={0x1, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000300)={0x3}, 0x8) (async) syz_genetlink_get_family_id$team(&(0x7f0000000340), r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={'sit0\x00', 0x0, 0x8, 0x7f81, 0x6, 0x180, {{0x15, 0x4, 0x3, 0x1, 0x54, 0x68, 0x0, 0x4, 0x4, 0x0, @broadcast, @rand_addr=0x64010101, {[@noop, @lsrr={0x83, 0x7, 0xa5, [@private=0xa010100]}, @timestamp_addr={0x44, 0xc, 0xa5, 0x1, 0x7, [{@broadcast}]}, @lsrr={0x83, 0x13, 0x73, [@multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, @rand_addr=0x64010102]}, @timestamp={0x44, 0x18, 0x95, 0x0, 0x2, [0x8000, 0x6, 0x4, 0x22, 0xe]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000540)={'erspan0\x00', &(0x7f00000004c0)={'sit0\x00', 0x0, 0x8000, 0x7, 0x529, 0x85, {{0xd, 0x4, 0x2, 0x0, 0x34, 0x64, 0x0, 0x7f, 0x4, 0x0, @local, @empty, {[@generic={0x88, 0x3, "aa"}, @noop, @cipso={0x86, 0x1a, 0x0, [{0x5, 0x8, "12cd51f2018d"}, {0x2, 0x6, "5898bb03"}, {0x1, 0x3, "b9"}, {0x6, 0x3, "d6"}]}]}}}}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000580)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_GET(r4, &(0x7f0000000700)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000006c0)={&(0x7f00000005c0)={0xd4, r5, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@HEADER={0x4}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @HEADER={0x90, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4000}, 0x4) (async) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), r0) sendmsg$TIPC_NL_NET_SET(r4, &(0x7f0000000b40)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000b00)={&(0x7f00000007c0)={0x328, r9, 0x510, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x400}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xef1c}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3945}, @TIPC_NLA_PUBL_TYPE={0x8}]}, @TIPC_NLA_NODE={0xe0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7fffffff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffff7}, @TIPC_NLA_NODE_ID={0xad, 0x3, "2267fc5a0a2e3f17057776f797281c3016432ae67f3087f36b8a6c7d2774658d4f85b95fac8d6ba12a2e6bbd121156b15204862858b6c2117041edd9dec41e869173a38b691119c18bdd66ef7cb58902b34843af067dd55beefd8fdbd6dda99fcf92702142226dbb9be2e255f333788f73b50568eef268f0b6ccf32fa17b3e96db498ac2ee4c58fefd09358f4b9688fbd159896fef1540eca062a8c8aa4a3d458a2b7fd9deec74334a"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x41dc}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x60}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10001}]}, @TIPC_NLA_MEDIA={0xb8, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf70d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x90000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_LINK={0x20, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}]}, @TIPC_NLA_MEDIA={0xcc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x64}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffe}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x44004}, 0x40000) (async) listen(r4, 0xf4) (async) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b80)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x100000, '\x00', r6, 0xffffffffffffffff, 0x3, 0x1, 0x3, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000d00)={r10, &(0x7f0000000c00)="ee8b3c048295044c1c01715e2e6197b1a5d1dc728db2e3e5b38e82a1267ca3da08649f1f36b16054dbac93c9264d6ffb33caf5404d0b543ecf154bc5663a2289d2db2cd4a115c0114e06bc47a37d9275b40113e79942d7a3fd1cea1621f58ffc72e2e4c82dae9a81bdb7afcccfd2832101fd25fece4e600f4c0cfe75103f6d839ce88744133d69933fa6bf44ab55252f8f22ea56b5ddd813ed6da12d72a1983e8588db54201afc5a2b71acd6ff4c", &(0x7f0000000cc0)=""/27}, 0x20) r11 = openat$cgroup_ro(r0, &(0x7f0000000d40)='memory.events.local\x00', 0x0, 0x0) (async) r12 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r12, &(0x7f00000016c0)={&(0x7f0000000d80)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10, &(0x7f0000001280)=[{&(0x7f0000000dc0)=""/41, 0x29}, {&(0x7f0000000e00)=""/90, 0x5a}, {&(0x7f0000000e80)=""/63, 0x3f}, {&(0x7f0000000ec0)=""/79, 0x4f}, {&(0x7f0000000f40)=""/201, 0xc9}, {&(0x7f0000001040)=""/163, 0xa3}, {&(0x7f0000001100)=""/176, 0xb0}, {&(0x7f00000011c0)=""/161, 0xa1}], 0x8, &(0x7f00000015c0)=[@mask_cswp={0x58, 0x114, 0x9, {{0x7, 0x7}, &(0x7f0000001300)=0x5, &(0x7f0000001340)=0x2, 0x3, 0x110, 0x7ff, 0x1, 0x50, 0x7}}, @rdma_args={0x48, 0x114, 0x1, {{0x80000000, 0xf}, {&(0x7f0000001380)=""/166, 0xa6}, &(0x7f0000001500)=[{&(0x7f0000001440)=""/2, 0x2}, {&(0x7f0000001480)=""/114, 0x72}], 0x2, 0x20, 0x7ff}}, @fadd={0x58, 0x114, 0x6, {{0x8, 0xa5fe}, &(0x7f0000001540)=0xfb8c, &(0x7f0000001580)=0x7a04546d, 0xdf, 0x2, 0xa, 0x4, 0x1a, 0x9}}], 0xf8}, 0x48814) (async) setsockopt$ARPT_SO_SET_REPLACE(r11, 0x0, 0x60, &(0x7f0000001740)={'filter\x00', 0x7, 0x4, 0x3d0, 0x0, 0x0, 0x1f8, 0x2e8, 0x2e8, 0x2e8, 0x4, &(0x7f0000001700), {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, 0x4, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7, 0x8}}}, {{@arp={@loopback, @multicast1, 0x0, 0xff000000, 0x5, 0x9, {@empty, {[0x0, 0xff, 0xff, 0x0, 0x0, 0x80]}}, {@mac=@local, {[0xff, 0xff]}}, 0x400, 0x9, 0x6, 0xea1b, 0x8, 0x6, 'ip6_vti0\x00', 'nr0\x00', {}, {}, 0x0, 0x1}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x73, 0xfffffffb, 0x8}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x420) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001b80), r4) socket$pppoe(0x18, 0x1, 0x0) (async) r14 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001c00), r0) sendmsg$L2TP_CMD_SESSION_GET(r11, &(0x7f0000001cc0)={&(0x7f0000001bc0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001c80)={&(0x7f0000001c40)={0x34, r14, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xe}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000004}, 0x40000c0) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r4, &(0x7f0000001e40)={&(0x7f0000001d00)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001e00)={&(0x7f0000001d40)={0xa8, r13, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf0}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x13}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}]}]}, 0xa8}}, 0x4000000) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp bisect: bisecting 30 programs bisect: split chunks (needed=false): <29> bisect: split chunk #0 of len 29 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 10, 22, 30, 2, 30, 5, 40, 24, 3, 11, 20, 26, 7, 5, 3, 2, 15, 15, 30] detailed listing: executing program 0: r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000300)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x0, 0x1, 0x0, @void, @value, @void, @value}, 0x50) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r1, &(0x7f00000011c0)="a0", 0x1, 0x4495, &(0x7f00000012c0)={0xa, 0x0, 0x0, @loopback}, 0x1c) shutdown(r1, 0x1) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r1, 0x84, 0x18, &(0x7f0000000140), &(0x7f0000000180)=0x8) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0x10, &(0x7f0000000580)=ANY=[@ANYBLOB="18050000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="00000000000000000094000000000000000000000000005fc273680000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000580)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000140)='sched_switch\x00', r2}, 0x10) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x19, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x100000, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socket(0x10, 0x80002, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MAX_AGE={0x8, 0x31}]}}}]}, 0x3c}, 0x1, 0xba01}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000007c0), 0xffffffffffffffff) unshare(0x2040400) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000020000000000000000000000850000000f000000850000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r5 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000100100000c000000fa000000000000ff"], 0x18}, 0x40) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f00000001c0)='netfs_rreq_ref\x00', r4}, 0x18) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000040)={r6, 0x0, 0x0}, 0x10) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000b40)={&(0x7f00000000c0)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r3, @ANYBLOB="010027bd7000fcdbdf250f000000063e4961f47cc83e3f3b310000da9d68145b18b8eb452fbd"], 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x810) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r8, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r9, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x2}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=ANY=[], 0xa0}}, 0x0) r10 = socket(0x10, 0x3, 0x0) sendmmsg(r10, &(0x7f0000000000), 0x400000000000235, 0x0) executing program 1: socket$inet_smc(0x2b, 0x1, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000000)={@multicast, @random="777de85bf4dd", @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x8, 0x3a, 0xff, @local, @mcast2, {[], @ndisc_rs}}}}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f00000011c0)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x801, 0x0, 0x0, {0x7, 0x0, 0xa}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x3c}, 0x1, 0x0, 0x0, 0x10}, 0x4) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)={0x80, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @loopback}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8}, @CTA_STATUS={0x8, 0x3, 0x1, 0x0, 0x100e}, @CTA_SEQ_ADJ_REPLY={0x14, 0xf, 0x0, 0x1, [@CTA_SEQADJ_CORRECTION_POS={0x5}, @CTA_SEQADJ_OFFSET_BEFORE={0xe6ba7615268e7f7}]}]}, 0x80}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000300000000000000000100736974001400028008000200ac1e010106000d00ff030000"], 0x40}, 0x1, 0xba01}, 0x0) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_REMOVE(0xffffffffffffffff, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000100)={0xac, r3, 0x20, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0xad}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x4}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x6}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0xe0}, @MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x4}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x1}, @MPTCP_PM_ATTR_ADDR_REMOTE={0x38, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @loopback}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @remote}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}]}, 0xac}, 0x1, 0x0, 0x0, 0x4}, 0x40000) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 0: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=@base={0x1, 0x4, 0x6, 0x3, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r1 = socket$kcm(0x10, 0x2, 0x0) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB='\v\x00'/20, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000008c0), &(0x7f0000000b80), 0x2000005, r2}, 0x38) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000340)={r0, &(0x7f0000000640)="87aa0abecf670dceba8f350bf354a5e0dc3faed171d650d741014e148c5b232b6e1b0a6cb160fd117e77447c6de84edd4ef9e41d73cb1ece6b51cb5a6381f90383a1a778718f551a88a06bb3cc44ddf3e081243a0fb4a4696ae33bc125b05f20b4154cf5f9a52d87d4e5dc09d42c2aad5b30703f02e636f48b70d0b2046d64ae5e3a56e7dd95186f098e233dae9c6acc796677d1b4622d6fe67176b654b5ec5e905f50fc31bf0b051dfb7a26a93fa4172112cf67398c0de89d03b804f0adc5a51cd3ef7defa1c197844981daad026a9840606884252ab4105b31ac1f893cfafc1fea6cdcc1848fdd5e8b57d367", &(0x7f0000000740)=""/156}, 0x20) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x6, 0x4, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xe, 0xc, &(0x7f0000000a80)=ANY=[@ANYBLOB="1800000000000000000000001000000018150000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005500000095"], &(0x7f0000000480)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000200)=0x0, &(0x7f0000000300)=0x4) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@bloom_filter={0x1e, 0x30e8, 0x3, 0xfffffff9, 0x4080, r3, 0x7, '\x00', r4, 0xffffffffffffffff, 0x1, 0x0, 0x1, 0xd, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000000), 0xcff5, r5}, 0x38) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r6, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r6, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000440)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r6, 0x84, 0x74, &(0x7f00000000c0)={r7, 0x0, 0x10, 0x6, 0xb1aa}, &(0x7f0000000040)=0x18) bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000240)={0x0, &(0x7f0000000040)=""/141, &(0x7f0000000500), &(0x7f0000000280), 0x4, r5}, 0x38) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x74, r10, 0x0, 0x11203}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8, 0x5, 0x1}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x800}, 0x10) sendmsg$kcm(r1, &(0x7f0000000600)={0x0, 0xfffffffe, &(0x7f0000000080)=[{&(0x7f0000000000)="2e00000010008188040f80ec59acbc0413a1f8480d0000005e140604000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x8001, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) socket$nl_xfrm(0x10, 0x3, 0x6) r11 = socket$rds(0x15, 0x5, 0x0) bind$rds(r11, &(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10) sendmsg$rds(r11, &(0x7f0000001e40)={&(0x7f0000000000)={0x2, 0x0, @loopback}, 0x10, 0x0, 0x0, &(0x7f00000004c0)=[@rdma_args={0x48, 0x114, 0x1, {{}, {&(0x7f00000014c0)=""/54, 0x36}, &(0x7f0000001540)=[{&(0x7f00000000c0)=""/21, 0x15}], 0x1}}, @rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f0000001a00)=[{&(0x7f0000001680)=""/82, 0x52}], 0x1}}], 0x90}, 0x0) r12 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r12, 0x84, 0x75, &(0x7f0000000000)={0x0, 0xcc}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r12, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r12, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback}, 0x1c, &(0x7f0000000500)=[{&(0x7f0000000140)="03", 0x1}], 0x1}}], 0x1, 0x34000811) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r12, 0x84, 0x77, &(0x7f0000000040)=ANY=[@ANYRES32=0x0, @ANYRES16, @ANYRES32=r12], 0x1000f) executing program 2: r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000580)="fc457c43aa3f7d64673331496d0983b8be420782d9ac4b57e91f62b9dda712d2ef95adf34bc11e0e33b7a5c2842e81cb", 0x30}], 0x1}}, {{&(0x7f0000000780)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10, 0x0, 0x0, &(0x7f0000000840)=ANY=[], 0x18}}], 0x2, 0x0) executing program 3: r0 = syz_genetlink_get_family_id$devlink(&(0x7f0000000580), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_GET(0xffffffffffffffff, &(0x7f0000000640)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000800)={0x100, r0, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@pci={{0x8}, {0x11}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}, {@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x1c}}]}, 0x100}}, 0x0) (async) r1 = socket$inet_tcp(0x2, 0x1, 0x0) (async, rerun: 32) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb010018000000000000001800000018000000020000000000000001000013070000000000000100"/50], 0x0, 0x32, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28) (rerun: 32) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) (async, rerun: 32) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0xfffffffffffffd51, &(0x7f0000000000)='cgroup\x00'}, 0x30) (async, rerun: 32) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000040)='cpu.max\x00', 0x2, 0x0) write$cgroup_int(r5, &(0x7f0000000080)=0x8, 0x12) (async, rerun: 64) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="b800000019000100000000000000000000000000000000000000000000000000e000000100000000000000000000000000000081000000000200000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000feffffff0000000001"], 0xb8}}, 0x0) (async, rerun: 64) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) (async) sendto(r1, &(0x7f0000000700)="9ab5808857d89c02fb45b512a3e405c6a18df8d13e5cf79d358fffe8a74dfd3756756c4fe8b50d3d96d0f9fa2059f757f3fb9090e0baec4219f1e878f050ffea02cb5f22934621245b9c587a8fe9ae5621d69347763fd81fafa83effdfb5b20c837d4f43ee97ed4ad995b2c03a90e528cc72156df5b7011d5dc7eb9b7cb3572510eb2fce21f1afc000da068a1f27ef4f8667bb6feae9fa6d5c59f3640c51385d818a97c6dce72528a17c83920d3d5a194d8c055e5622100819b50fe0740c2cbbd77139520f776b561443685167d9ca17c0514fdec1df9d5b9708c6db71c861f9fbe708c3946118c89794ffa11aff077ec950d7", 0xf3, 0x804, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r1, 0x1, 0x25, &(0x7f00000002c0)=0x6003, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r1, 0x6, 0x16, &(0x7f0000000080)=[@window, @mss, @sack_perm, @window, @sack_perm, @timestamp, @timestamp, @timestamp], 0x8) (async) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000001c0), 0x4) (async) r6 = socket$inet(0x2, 0x2, 0x1) (async) r7 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r7, &(0x7f0000000100)={0x18, 0x0, {0x2, @local, 'wg0\x00'}}, 0x1e) sendmsg(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000001c0)="5500000018007f5f00fe01b2a4a2809302060000ff41fd01040400000a0012000200", 0x22}, {0x0}], 0x2, 0x0, 0x0, 0x7a000000}, 0x0) (async) r8 = socket$kcm(0x21, 0x2, 0x2) (async) r9 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r9, &(0x7f0000000940)={0x0, 0xe, &(0x7f0000000000)=[{&(0x7f00000001c0)="d8000000180081054e81f782db44b904021d005c06007c09e8fe55a10a0015400100142603600e1208000b0000000401a80016000800014009001100036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360d070100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) sendmsg$kcm(r8, &(0x7f0000000080)={&(0x7f0000000000)=@generic={0x25, "4bc475336c5858aa36d22e2605dd52416ad64dea6679d6760eb3ae06eeecab8fb38f5dba7f566ef424bcfc034322e5179b4783cd9ede9144e15085deeab643ea8a8f0048f0be4c32ec727eba69e206dbe9dea8b7cf46938ee7feab499bd8db55f5c530e2d55a128d603119be1625aca347038b73ee81502998f370791659"}, 0x80, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYRES16=r4], 0x18}, 0x8000000) (async, rerun: 32) close(r8) (async, rerun: 32) sendmsg$inet(r6, &(0x7f0000000600)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, &(0x7f00000000c0)=[{&(0x7f0000002100)="0800a9fc0da6b30a", 0x8}], 0x1, &(0x7f0000001d00)=ANY=[@ANYBLOB="18000000000000000000000002"], 0x30}, 0x0) (async) sendmmsg$inet(r1, &(0x7f0000000a00)=[{{0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000200)="27fe6da9b9cebbb18bafd9ccd79f0efca7a903c7a6fb41ecbd409f1a3db49cc612de34d4e9a8af95005aee32dbf7b63362533b67d254932beb05349e93971a53b856ce30901dc6d5679605b1dfde5241ca7183a9232bcb8c29e4fa570f53f09a5c34fd7e046ae08a1231a6f5654f2a870ccb697f41bf7a60a68033e80ed7dc6c7c06deecaaf2fbbd4e2bea22582fa90d8d14aa07b40e9c3415afb5", 0x9b}, {&(0x7f0000000100)="ac04048ea155344276", 0x9}, {&(0x7f0000000140)="a3dab3a1efd701da2d9607fa7ae104fe4e788344012ee808a9760da3249ac6", 0x1f}, {&(0x7f0000000300)="f1374fb8259ce1fcd099ef0a9ce716aa1c8be4e98a99f15b8069b924e58f605e96f1e947ecab1f70a511d0868f949bd4f8efe41209d6e6ae2413862ce802da43f9f1520ebded89d4947eb2685f780aa5db2a3728c288", 0x56}, {&(0x7f0000000380)="a58df42e976cc6e43303b58c453196fd57f61c89e96c0ac0ad0c4c19a1b80b2e78bf8fc8a904310f90732a6c316473c27706680d7dbadd7fbeb2a98436b22b99174eb9a36e84e56ddfa1e59ca6b03bcc32c508715075ed74ed334214928bac4f19ffe2a8f6bdef50f19499bd2b31f380b7948507479bd6170e98c4106a5c0edf30fa5e08fdfdb9571231fd07a95edf125df4433624b9e2df35f8d92ceb09a9fbf78fa03e044a99a8c9f4e524cd1ac5148a20575ba9f60acc4459ae3b5d84366dee82a25d7884711d9f7586cafb21b4ac5ce5eb48e31d352deb0e5474dc11", 0xde}, {&(0x7f0000000480)="bfdf8f623b14d1b0d12a6c9decb13220b9ee0af979d90e2ef5aa0ebcbc792d3411da", 0x22}], 0x6}}], 0x1, 0x4008095) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x10, 0xc, &(0x7f0000000500)=ANY=[@ANYBLOB="18000000000000000000000000000000850000000e00000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000006b00000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) executing program 2: r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000200), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)={0x5, 0x413, 0x0, {}, {}, {0x0, 0x0, 0x1}, 0x1, @can={{}, 0x7, 0x7, 0x0, 0x0, "94b1c39a3cc2fbfd"}}, 0x48}}, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x24, 0x3c, 0x9, 0x0, 0x0, {0x2}, [@typed={0x4, 0x200}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x3, 0x0, 0x0, @uid}]}]}, 0x24}}, 0x0) executing program 0: socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2a, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @val, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x60}}, 0x0) (async) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000007c0)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x2a, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @default, 0x1, @void, @val, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}]}, 0x60}}, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000003c0)={0xffffffffffffffff}) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000000)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="cf0400000000000000001300000008000300", @ANYRES32=r6, @ANYBLOB="0500130092848b000a00060008021100000100000600100080050000060012"], 0x40}, 0x1, 0x0, 0x0, 0xc0}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_INTERFACE(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r8, 0x5, 0x3, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x9}]}, 0x24}}, 0xb4) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000001c40)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2ed0300000000000000af99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14008c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f0000100000006da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729433282830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c4159b364a4fd7013f34db173a4fdacf15229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3ab60fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4978ea8e4aa37014191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be867a28f09c5877fc2355ecdc9c30dcb2d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff3a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4e064c98e494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb357b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88cf573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50265a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867857ed13a4fa4ae033a09673866cd77f4bcdaaa05207166b19a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d9a0e06da200481cde8bf475bc3e1fe9c0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a00"/3590], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x2e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0x3, &(0x7f0000001980)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (async) r11 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r11, 0xffffffffffffffff}, &(0x7f00000001c0), &(0x7f0000000380)=r10}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0x10, &(0x7f0000000000)=@framed={{0x18, 0x8}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r12}, {}, {}, {0x7, 0x0, 0xb, 0x7}}, @printk]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x6, &(0x7f0000000000)=@framed={{0xffffffb4, 0x8, 0x0, 0x0, 0x0, 0x73, 0x11, 0x3a}, [@func={0x85, 0x0, 0x1, 0x0, 0x2}, @call={0xb7}, @exit={0x95, 0x0, 0xc2}], {0x95, 0x0, 0x1200}}, &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) socket$alg(0x26, 0x5, 0x0) (async) r13 = socket$alg(0x26, 0x5, 0x0) bind$alg(r13, &(0x7f00000000c0)={0x26, 'hash\x00', 0x0, 0x0, 'sha512-ssse3\x00'}, 0x58) r14 = accept4(r13, 0x0, 0x0, 0x0) sendmsg$unix(r14, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)="1709f53e25f27116776b40cd3c550d298dd1b9266c15c25b83f011b965bb18efe36db9195a46d7dd34", 0x29}, {&(0x7f0000000240)="8bd751665b27b5ee408c629bceca8e7af4e15e0c93db7c7cf5b0d8bdaf6d95e8f449260f9dd2f4b86bca6d5bc7951cb16b4c5e340be7b089af5481907baf4c757bc0ff04cea7", 0x46}], 0x2}, 0x0) (async) sendmsg$unix(r14, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000140)="1709f53e25f27116776b40cd3c550d298dd1b9266c15c25b83f011b965bb18efe36db9195a46d7dd34", 0x29}, {&(0x7f0000000240)="8bd751665b27b5ee408c629bceca8e7af4e15e0c93db7c7cf5b0d8bdaf6d95e8f449260f9dd2f4b86bca6d5bc7951cb16b4c5e340be7b089af5481907baf4c757bc0ff04cea7", 0x46}], 0x2}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r9}, 0xa) r15 = syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) ioctl$sock_inet_SIOCSIFADDR(r15, 0x8916, &(0x7f0000000200)={'veth1_to_batadv\x00', {0x2, 0x4e21, @broadcast}}) r16 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r16, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r16, &(0x7f0000000340)="24000000010001", 0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x3, 0x4, &(0x7f0000000000)=@framed={{0x18, 0x2}, [@call={0x85, 0x0, 0x0, 0x7a}]}, &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) executing program 3: r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0xc, @broadcast, 'veth1_to_team\x00'}}, 0x1e) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x101a40, 0x0) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0) r2 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f00000000c0)=0x1) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x2) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000000100)) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0xfec2, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6gre0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc890}, 0x20000000) socket$pppoe(0x18, 0x1, 0x0) (async) connect$pppoe(r0, &(0x7f0000000080)={0x18, 0x0, {0xc, @broadcast, 'veth1_to_team\x00'}}, 0x1e) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000140), 0x101a40, 0x0) (async) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x26e1, 0x0) (async) socket$pppoe(0x18, 0x1, 0x0) (async) connect$pppoe(r2, &(0x7f0000000080)={0x18, 0x0, {0x3, @local, 'geneve0\x00'}}, 0x1e) (async) openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) ioctl$PPPIOCATTCHAN(r3, 0x40047438, &(0x7f00000000c0)=0x1) (async) ioctl$PPPIOCATTCHAN(r1, 0x40047438, &(0x7f0000000040)=0x2) (async) ioctl$PPPIOCBRIDGECHAN(r1, 0x40047435, &(0x7f0000000100)) (async) socket$nl_rdma(0x10, 0x3, 0x14) (async) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r4, &(0x7f00000000c0)={0x0, 0xfec2, &(0x7f0000000080)={&(0x7f0000000040)={0x38, 0x1403, 0x1, 0x70bd28, 0x25dfdbfe, "", [{{0x9, 0x2, 'syz1\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ip6gre0\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc890}, 0x20000000) (async) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=@newlink={0x48, 0x10, 0x439, 0x70bd26, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2404}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x4}}}, @IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}]}, 0x48}}, 0x4050) socket$inet6(0xa, 0x3, 0xffffffff) executing program 4: mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2000002, 0x4ca31, 0xffffffffffffffff, 0x0) r0 = socket(0x15, 0x5, 0x0) getsockopt(r0, 0x200000000114, 0x2711, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=@newtaction={0x64, 0x30, 0x9, 0x0, 0x0, {}, [{0x50, 0x1, [@m_mpls={0x4c, 0x1, 0x0, 0x0, {{0x9}, {0x20, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{0x1, 0x10000, 0x10000000, 0x1, 0x5}, 0x4}}]}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}]}]}, 0x64}}, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'syztnl0\x00', 0x0, 0x29, 0xfa, 0xfd, 0xfffffffc, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}, @mcast1, 0x7800, 0x80, 0x4b0c, 0x3ba}}) sendmsg$nl_route(r2, &(0x7f0000000380)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x40020000}, 0xc, &(0x7f0000000300)={&(0x7f00000002c0)=@bridge_getlink={0x34, 0x12, 0x20, 0x70bd27, 0x25dfdbfc, {0x7, 0x0, 0x0, r3, 0x20831, 0x804}, [@IFLA_MTU={0x8, 0x4, 0x6c}, @IFLA_LINKMODE={0x5, 0x11, 0xb}, @IFLA_IFALIASn={0x4}]}, 0x34}, 0x1, 0x0, 0x0, 0x40000}, 0x44000) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000000)={r1}, 0x4) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x11, &(0x7f0000000840)=@framed={{}, [@call={0x85, 0x0, 0x0, 0x75}, @snprintf={{}, {}, {}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f00000000c0)='tlb_flush\x00', r4}, 0x10) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) (async) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r2 = socket(0x15, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x2715, 0x0, &(0x7f0000000000)) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) (async) r3 = socket$tipc(0x1e, 0x5, 0x0) syz_emit_ethernet(0x8e, &(0x7f0000000380)={@local, @remote, @val={@void, {0x8100, 0x2, 0x1}}, {@llc={0x4, {@snap={0xaa, 0xaa, "a6", "1e63b1", 0x17, "854a2c9eb0e75f511eee29e2d3bdc698f953ffe476ddeb16c495930520120e52a6564849a2b01c197f80b34bd352951c14417c7c195be632824bac5890209b590a32c05a809905bafe6182e2ca2fed36074e8ff21d8265bd8071998870732631558773ec9bd63c8cdd1065ae500811642ed42abe"}}}}}, &(0x7f0000000240)={0x1, 0x1, [0x349, 0x5fd, 0x1c0, 0x563]}) (async) bind$tipc(r3, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) openat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x2a813, r4, 0x0) (async) preadv(r4, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x22, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) (async) ioctl$sock_inet6_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000040)) (async) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r7, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) bind$xdp(r7, &(0x7f0000000100)={0x2c, 0x9, r6}, 0x10) (async) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r8, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0xa4}, {0x6}]}, 0x10) (async) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x42, 0x1}, 0x10) sendmsg$tipc(r0, &(0x7f00000006c0)={&(0x7f0000000540)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x10000000}}, 0x10, 0x0}, 0x0) executing program 3: r0 = socket(0x2a, 0x3, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r1, 0x29, 0x4c, &(0x7f0000000540)=ANY=[], 0x60) sendto$inet6(r0, &(0x7f0000000080)="7800000018002507b9409b14ffff00000202be04020506050e130204430009003f0020480a0000000d0085a168d0bf46d32345653600648d27000b000a00000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a3200040016000b000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r2, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x854}, 0x1) sendto$inet6(r0, &(0x7f00000001c0)="020ff3c63a9fae7a920057af134180ea10fb88e703ae6c10ad7b3106544060587d87aba5c8fb2bfcaa68ea68cbc8c820d42da8c13a4040e9485b54bffdcabc88ba33fcd13806c9fcc0645ee4a730cc89dd039f8e70fda358d11ab43cac3fd9340a497c0c2819b37c77e7845a406b485ffbcb6899a864d36ec06be2bcaccfe9797cfb3af4b22d0c0afedb56dcf802b703bdba96fe69abffe300cc76c8a55735024fc7f662e5d1845abefbcc98f34c041d023f211c5f659c5e7401a09a58f64cd30ef2c79001582f7ab3e0db06984b976383", 0xd1, 0x80805, &(0x7f00000002c0)={0xa, 0x4e23, 0x7, @empty, 0x6}, 0x1c) executing program 2: r0 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) (async) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) (async) socketpair(0x28, 0x4, 0x233f, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000080)=0x14) executing program 0: r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3c0, 0x0, 0xe8, 0xe8, 0x2d8, 0x2d8, 0x2d8, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x20, '\x00', 0x0, 0x2d8}}, {{@uncond, 0xc0, 0x100, 0x0, {0x0, 0x1e03}}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "2c3bb27d9d5b379b853c7744b526e29755ec721db80fdb00f95f8a608b8d"}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'netpci0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410) bpf$PROG_LOAD(0x5, &(0x7f0000001780)={0x17, 0xf, &(0x7f0000000240)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x5}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @cgroup_sysctl, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) executing program 3: r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{&(0x7f0000000300)={0x2, 0x4e24, @remote}, 0x10, 0x0}}, {{&(0x7f0000000780)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10, 0x0, 0x0, &(0x7f0000000840)=ANY=[], 0x18}}], 0x2, 0x0) executing program 4: r0 = gettid() r1 = syz_open_procfs$namespace(r0, &(0x7f0000000000)) (async, rerun: 32) r2 = socket(0x2a, 0x2, 0x0) (async, rerun: 32) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x4}}}]}, @NFTA_RULE_COMPAT={0x4}]}], {0x14}}, 0x58}}, 0x0) (async, rerun: 64) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000000000000000000000b00000008000300000000000c00018008000000", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) (async, rerun: 64) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="140100001f000504000000000000000004"], 0x114}], 0x1}, 0x0) (async, rerun: 64) getsockname$packet(r2, 0x0, &(0x7f0000001480)) (rerun: 64) socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x801) socket$netlink(0x10, 0x3, 0x0) mkdirat$cgroup(r1, &(0x7f0000000000)='syz0\x00', 0x1ff) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, &(0x7f0000000000)=ANY=[@ANYRES8=r3], &(0x7f0000000480)='GPL\x00', 0x8000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) executing program 2: bind$rds(0xffffffffffffffff, 0x0, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@ipv4_newrule={0x1c, 0x20, 0x301}, 0x1c}}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r3) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)={0x58, r4, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xfeffffff}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}]}, 0x58}}, 0x0) executing program 3: connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @multicast1}, 0x10) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r0) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000140)=r0, 0x4) (async) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xa0}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000840}, 0x10) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000280)={0x1, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000300)={0x3}, 0x8) (async) syz_genetlink_get_family_id$team(&(0x7f0000000340), r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={'sit0\x00', 0x0, 0x8, 0x7f81, 0x6, 0x180, {{0x15, 0x4, 0x3, 0x1, 0x54, 0x68, 0x0, 0x4, 0x4, 0x0, @broadcast, @rand_addr=0x64010101, {[@noop, @lsrr={0x83, 0x7, 0xa5, [@private=0xa010100]}, @timestamp_addr={0x44, 0xc, 0xa5, 0x1, 0x7, [{@broadcast}]}, @lsrr={0x83, 0x13, 0x73, [@multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, @rand_addr=0x64010102]}, @timestamp={0x44, 0x18, 0x95, 0x0, 0x2, [0x8000, 0x6, 0x4, 0x22, 0xe]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000540)={'erspan0\x00', &(0x7f00000004c0)={'sit0\x00', 0x0, 0x8000, 0x7, 0x529, 0x85, {{0xd, 0x4, 0x2, 0x0, 0x34, 0x64, 0x0, 0x7f, 0x4, 0x0, @local, @empty, {[@generic={0x88, 0x3, "aa"}, @noop, @cipso={0x86, 0x1a, 0x0, [{0x5, 0x8, "12cd51f2018d"}, {0x2, 0x6, "5898bb03"}, {0x1, 0x3, "b9"}, {0x6, 0x3, "d6"}]}]}}}}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000580)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_GET(r4, &(0x7f0000000700)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000006c0)={&(0x7f00000005c0)={0xd4, r5, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@HEADER={0x4}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @HEADER={0x90, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4000}, 0x4) (async) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), r0) sendmsg$TIPC_NL_NET_SET(r4, &(0x7f0000000b40)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000b00)={&(0x7f00000007c0)={0x328, r9, 0x510, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x400}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xef1c}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3945}, @TIPC_NLA_PUBL_TYPE={0x8}]}, @TIPC_NLA_NODE={0xe0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7fffffff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffff7}, @TIPC_NLA_NODE_ID={0xad, 0x3, "2267fc5a0a2e3f17057776f797281c3016432ae67f3087f36b8a6c7d2774658d4f85b95fac8d6ba12a2e6bbd121156b15204862858b6c2117041edd9dec41e869173a38b691119c18bdd66ef7cb58902b34843af067dd55beefd8fdbd6dda99fcf92702142226dbb9be2e255f333788f73b50568eef268f0b6ccf32fa17b3e96db498ac2ee4c58fefd09358f4b9688fbd159896fef1540eca062a8c8aa4a3d458a2b7fd9deec74334a"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x41dc}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x60}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10001}]}, @TIPC_NLA_MEDIA={0xb8, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf70d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x90000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_LINK={0x20, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}]}, @TIPC_NLA_MEDIA={0xcc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x64}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffe}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x44004}, 0x40000) (async) listen(r4, 0xf4) (async) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b80)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x100000, '\x00', r6, 0xffffffffffffffff, 0x3, 0x1, 0x3, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000d00)={r10, &(0x7f0000000c00)="ee8b3c048295044c1c01715e2e6197b1a5d1dc728db2e3e5b38e82a1267ca3da08649f1f36b16054dbac93c9264d6ffb33caf5404d0b543ecf154bc5663a2289d2db2cd4a115c0114e06bc47a37d9275b40113e79942d7a3fd1cea1621f58ffc72e2e4c82dae9a81bdb7afcccfd2832101fd25fece4e600f4c0cfe75103f6d839ce88744133d69933fa6bf44ab55252f8f22ea56b5ddd813ed6da12d72a1983e8588db54201afc5a2b71acd6ff4c", &(0x7f0000000cc0)=""/27}, 0x20) r11 = openat$cgroup_ro(r0, &(0x7f0000000d40)='memory.events.local\x00', 0x0, 0x0) (async) r12 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r12, &(0x7f00000016c0)={&(0x7f0000000d80)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10, &(0x7f0000001280)=[{&(0x7f0000000dc0)=""/41, 0x29}, {&(0x7f0000000e00)=""/90, 0x5a}, {&(0x7f0000000e80)=""/63, 0x3f}, {&(0x7f0000000ec0)=""/79, 0x4f}, {&(0x7f0000000f40)=""/201, 0xc9}, {&(0x7f0000001040)=""/163, 0xa3}, {&(0x7f0000001100)=""/176, 0xb0}, {&(0x7f00000011c0)=""/161, 0xa1}], 0x8, &(0x7f00000015c0)=[@mask_cswp={0x58, 0x114, 0x9, {{0x7, 0x7}, &(0x7f0000001300)=0x5, &(0x7f0000001340)=0x2, 0x3, 0x110, 0x7ff, 0x1, 0x50, 0x7}}, @rdma_args={0x48, 0x114, 0x1, {{0x80000000, 0xf}, {&(0x7f0000001380)=""/166, 0xa6}, &(0x7f0000001500)=[{&(0x7f0000001440)=""/2, 0x2}, {&(0x7f0000001480)=""/114, 0x72}], 0x2, 0x20, 0x7ff}}, @fadd={0x58, 0x114, 0x6, {{0x8, 0xa5fe}, &(0x7f0000001540)=0xfb8c, &(0x7f0000001580)=0x7a04546d, 0xdf, 0x2, 0xa, 0x4, 0x1a, 0x9}}], 0xf8}, 0x48814) (async) setsockopt$ARPT_SO_SET_REPLACE(r11, 0x0, 0x60, &(0x7f0000001740)={'filter\x00', 0x7, 0x4, 0x3d0, 0x0, 0x0, 0x1f8, 0x2e8, 0x2e8, 0x2e8, 0x4, &(0x7f0000001700), {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, 0x4, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7, 0x8}}}, {{@arp={@loopback, @multicast1, 0x0, 0xff000000, 0x5, 0x9, {@empty, {[0x0, 0xff, 0xff, 0x0, 0x0, 0x80]}}, {@mac=@local, {[0xff, 0xff]}}, 0x400, 0x9, 0x6, 0xea1b, 0x8, 0x6, 'ip6_vti0\x00', 'nr0\x00', {}, {}, 0x0, 0x1}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x73, 0xfffffffb, 0x8}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x420) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001b80), r4) socket$pppoe(0x18, 0x1, 0x0) (async) r14 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001c00), r0) sendmsg$L2TP_CMD_SESSION_GET(r11, &(0x7f0000001cc0)={&(0x7f0000001bc0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001c80)={&(0x7f0000001c40)={0x34, r14, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xe}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000004}, 0x40000c0) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r4, &(0x7f0000001e40)={&(0x7f0000001d00)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001e00)={&(0x7f0000001d40)={0xa8, r13, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf0}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x13}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}]}]}, 0xa8}}, 0x4000000) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 4, 30, 20, 30, 5, 30, 14, 9, 27, 22, 20, 26, 7, 5, 3, 2, 15, 15, 30] detailed listing: executing program 1: openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000200018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) pipe(&(0x7f0000000000)) socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket(0x1, 0x803, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$rds(0x15, 0x5, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid_for_children\x00') r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000140)=ANY=[@ANYBLOB="44000000150a0309000000000000000000000008090001"], 0x44}, 0x1, 0x0, 0x0, 0x24000819}, 0x40008800) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r5, &(0x7f00000001c0)={&(0x7f0000000300)=@id, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000940)="5763f922081ae50887ede09da114c1daa077f9611f8aa81d1b6fa5f806897377d6aa8524a8b1d8c81597ae6a3411d62b43ead10f470c911e8223cee2d6745ff65b450f8b0b46f900c910f852", 0xff20}, {&(0x7f0000000280)="b57af26468ffde59db204ffaa467c0af523b9e6d93dd62dad3d2f90b45e80eb530982e2a1a0b9ebc2c7113d4f93982f87d0ced6312bdcaa996c13c02d027870ae0bdbed8b104a10605ae3939cfa8e7d4ae5e2f97b5958bed4a4430c01d04f980fac5e88de756ec949e14a35bfb3f32197c05b451", 0x74}, {&(0x7f00000009c0)="3d408cd47846fd99d1d1a4df38e0afdd03a817bf3b4673e575b2c253bae12d98c4d5e4e6d317ba457f2d0de6e1fbc5a43bae0d257cda31fb579139135de49db225bf75a3dea059b4a7a9808dd72eb1bd84d0cf9959907ad6b1e1ec718aa8d5004fd0acd19045d8d6e0f04b6b4497bb3126e4ad0d033ef175a58f55d0993d32bb3a10246c0e9ed8956592d6b51d4c1b3d35b68e6a354f5bdddcb0c943411abe361cd03acfa5d2f09a07700d9ce62314a233dc06de1a", 0xb5}, {&(0x7f0000000a80)="a840c8a67da22f1b2c4e068bb1ad9c499f093b4480b55eb7b9408f5400cc74932ab986ca937640a84378eb6446626516e84b0055936bb61fac109e2624e86903d729b0b10b4f16db7da1fa3aaa808fe333de0c9316c2412cb9ed2d604f8b3fa52416302221487c294ae9dc54783573eb5e7c1027fc39fa60c39afee14fb7cf3e6ef0041470dfd6a4a356a1d7e20a437bcadc7f0b5afa9f9d68bccd88dc02cc0150149950fdf196f5aa69b6c4d17ff0e4f1eb12c021fb1a6ff17ea6cd44b55cae0d9a054286ac6428d5a8d2ec34f045da5e7dbc1f8db2dcc83f53affd659e752b75f3bf443e576a5978614c0ed54741afa3ef7ac2b597143149c19c2fe9130a6f065fa277c2", 0x9c}, {&(0x7f0000000600)="c016c55101fc98bba00b0c2946a2b285871ce0494875c9d8979d34a99a409dcb328a6ff1e31414ec38af8d9348d49550faf55f18c1d9f281054ffbe9a13132e9a05e0542a376762a4d799b6b4f0311f62189f67e7708285a203492767e25e6bc4d28d6d3f8d9f50c2660483f8f942ecb733e84f8619101c2ec2ec357bec450d092e6068a319a9f761d766e6ae151f3f3cb790dda0a6dbc381be1a87e4d992bc55e39f166e65d1a5997bc4d255f00c45f6264f7b459ce6fc78a91f8935fa3aa5fe8be532e06387d82f07e", 0xca}, {&(0x7f0000000700)="f32ced1978f6103c6709573259e317066e84d42f18d090e52035bcf2ddcf8761f30c8179d42f2d06e49766e18561147a88e7ab4a817816b9da02e1744bc7eb653eb04ab70b5bf5111e01923c9bd0f4b72df99f19253083a444b5fbf214a2e9fbbc352a08731643692912aebd09546ccb28837254a30d1e53084dd7f6b7114fa3825fcbae9443ec15fb31bca97a87824d4bc8b632cf971bfb523a", 0x9a}], 0x6, &(0x7f0000000840)="a6d462c399e20d9d7ab19933a9b3d0e1d617be45eb50440e1e51f20cd773cd1b34e2669a511f6292d81a777376560dc1daae580d2419af271bdd485f32ddaa3679178bcbe6ff6f5d5d758535afbe2a930342eaa16108a32d9d31fbfe8bf4d89784440c3ff3fef2f998aebc9634", 0x6d}, 0x80) close(r5) recvmsg(r4, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x101d0}], 0x1, 0x0, 0xfffffffffffffe25}, 0x0) sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000000600)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x23c, 0x13, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_OBJ_USERDATA={0x4e, 0x8, "cc7bcce700116ac2ae434218d6d6f76d8f020ee10251322a2687b5988e023da99cf9aadc7e65db08816fc4b9810b2bff50c46e06d1827d0b08c8e1d05449b3bff40e32706c79e1a43570"}, @NFTA_OBJ_USERDATA={0x26, 0x8, "fe9b0c3b8bbfa879ced36c141f9e1ff9fda1035413ee351da8b9d0fe02f368053729"}, @NFTA_OBJ_USERDATA={0xd4, 0x8, "bd50fbc045da38f1f3370aff5eb2003235c726f048470c3ce3793535adca73403ee3f9d1e716ebbec342ad1915ef537880986309f7ec817a626a20d61248afe54bc0602882bda3d31848f7ad90dc001df7d8750d61e8cf6283462e69661a3183308b2f4fe5db6bb1cbfa931c893f84315f0620ce1512bc1d1b6b065a36d69aad47035570a39ff113482872d4dec3112f3483edff95a2fad821b647d83bf6adc5b1acf8d25d4cb2525678ff36f600d501880935da17ae4304e16dbb9f81e242bd564835f9b406a3ffc5844a595087ffb5"}, @NFTA_OBJ_USERDATA={0xa9, 0x8, "3bf954990a8fe7afffcd5dbba809acdc2ca3e9801c9c691cbee3bc2834f4cae281df53d29269aebd53e55f13c7eee013116a298a217c16fba3187f8c92f4992ebc4414636a54b122788bdfc477aab683fa9047eeb900c3f62810cd43eba756a61b890c912c68abf4542a06711aea69389224ab71c68cb318ad4c6d90b9fce9f499bd81bcc9e75ac137baecbe762682166dcabab6bc3c5c325ce185124e588e59d4cb86a524"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x23c}, 0x1, 0x0, 0x0, 0x4004044}, 0x4004818) socket$inet6_sctp(0xa, 0x1, 0x84) pipe(&(0x7f0000000100)) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c0000003ae16696cfcd61f38f00000304000000003f00000000000000", @ANYRES32=0x0, @ANYBLOB="a5fdad88000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r6, @ANYBLOB], 0x4c}}, 0x0) executing program 4: r0 = socket$kcm(0x10, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@ipv6_getaddrlabel={0x24, 0x4a, 0x1, 0x0, 0x0, {}, [@IFAL_LABEL={0x4}]}, 0x24}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f8480b0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=@newsa={0x10c, 0x10, 0x1, 0x0, 0x0, {{@in=@local, @in=@local}, {@in6=@private1, 0x0, 0x3c}, @in=@dev, {}, {0x0, 0x0, 0x0, 0x5}, {}, 0x0, 0x0, 0xa, 0x2}, [@coaddr={0x14, 0xe, @in6=@ipv4={'\x00', '\xff\xff', @loopback}}, @XFRMA_SET_MARK={0x8}]}, 0x10c}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x13, 0x4, &(0x7f0000000040)=ANY=[], 0x0, 0x800fc5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r2 = openat$cgroup_devices(r1, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x1) sendfile(r3, r2, &(0x7f00000003c0)=0x4000000001ff, 0x10000) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005d80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000000)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x88000, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'lo\x00', 0x1000}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000042e67ca8f39352320b318b0766fc6f9373230950f1d71b89d69c6ec4807fa578697a2fe29c36e3aec21422582697b5e8fd5d6046990852aaf668ce4331"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xa, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000095000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) writev(0xffffffffffffffff, &(0x7f00000002c0), 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000000)) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x100) r7 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r7, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x18}, 0x0) listen(r7, 0x2f3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x3a8, 0x0, 0xc8, 0x8, 0x180, 0x5803, 0x2d8, 0x2e8, 0x2e8, 0x2d8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @private1, [], [], 'pim6reg0\x00', 'wlan0\x00'}, 0x0, 0x118, 0x180, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@pkttype={{0x28}, {0x7, 0xddad}}, @common=@dst={{0x48}, {0x4}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x0, 0x0, 0x0, 'pptp\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x138, 0x158, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'dvmrp0\x00', 'batadv_slave_1\x00', 0x12, 0x3}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000002304e800000000000000ea850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r2) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)={0x14, r3, 0x1, 0x20}, 0x14}}, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f00000004c0)='svcrdma_decode_rseg\x00', r1, 0x0, 0x188158f2}, 0x18) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f00000001c0)='netlink_extack\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x1c, 0x3c, 0x107, 0xfffffffd, 0x0, {0x3, 0x7c}, [@nested={0x4, 0x7a}, @nested={0x4, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x488c0}, 0x24040880) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'ip6gre0\x00', r6, 0x0, 0x0, 0x0, 0x0, 0x0, @private0, @private0, 0x7800, 0x8, 0x7, 0x7}}) unshare(0x22020400) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) unshare(0x20400) (async, rerun: 32) close(r7) (async, rerun: 32) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@deltfilter={0x30, 0x2d, 0x1, 0x0, 0x0, {}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r1}, 0x10) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket(0x15, 0xf, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = syz_init_net_socket$x25(0x3, 0x5, 0x3) ioctl$SIOCX25SFACILITIES(r5, 0x89e3, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000880)=@nat={'nat\x00', 0x19, 0x2, 0x348, [0x20000280, 0x0, 0x0, 0x200002b0, 0x200002e0], 0x2, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="29000000000000000000000000000021000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000400000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000300000000000000ffff0000000000000000000000000000000062726983676530000000000000000000736974300000000000000000000000007465616d300000000000000000000000aaaaaaaaaaaa000000000000aaaaaaaaaabb0000000000000000d8010000d801000010020000636f6d6d656e7400000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073746174697374696300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff000000001b0000000000000000007465616d5f736c6176655f310000000069726c616e300000000000000000000069726c616e3000e575dd73000000000073797a6b616c6c6572300000000000000180c2000000000000000000f646793b7b3900000000000000007000000070000000a8000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff00000000"]}, 0x3c0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002c0001000000000000000000040100800c0000000000000000000000140001000100000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c226237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb64"], 0x114}], 0x1}, 0x0) r6 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000700), 0x4) bpf$ITER_CREATE(0x21, &(0x7f0000000840)={r6}, 0x8) syz_genetlink_get_family_id$ethtool(&(0x7f0000000800), r0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000600)={'syztnl2\x00', &(0x7f0000000980)={'gretap0\x00', 0x0, 0x7800, 0x8, 0x80000000, 0x6, {{0x1e, 0x4, 0x1, 0x0, 0x78, 0x65, 0x0, 0x7, 0x2f, 0x0, @rand_addr=0x64010102, @local, {[@noop, @timestamp={0x44, 0x1c, 0xf5, 0x0, 0xe, [0x2, 0x5, 0x5, 0x1a48, 0x5, 0x100]}, @ssrr={0x89, 0x2f, 0x70, [@private=0xa010102, @empty, @multicast1, @multicast1, @empty, @multicast2, @empty, @empty, @local, @broadcast, @multicast2]}, @rr={0x7, 0x17, 0xf4, [@empty, @multicast1, @empty, @broadcast, @remote]}]}}}}}) sendmsg$nl_route(r3, &(0x7f00000006c0)={&(0x7f0000000140), 0xc, &(0x7f0000000680)={&(0x7f0000000c00)=ANY=[@ANYBLOB="78001200060026bd70006f7256855c8f5405e164c0a06d1cebfddbdf250000516664cba3408179557096d7dbac0000a3237d426c1c7177ff4ba7558bc80aedd52b1126f4dcc26e8d97b003900119a31ea5a406789bf62b5d0db99ad1323bfb07519e1c657f32ca02000000a969cd959c7d511fceafdf538a3c353c3566740ac673b063c452981e97c0acd42f16f11d1d8266ed29681d3186685efd6c3471bd6f255d00d25e3daa2b11f52191d4d06d30d62139c957643eeff008bdad78908497997f03d501ec5a73cff4280ca7562d78ae07cc0da184003e0a8bfd0862b50eddcfad66e3d1769530e9e88352f6c6b34b61189250e52f4d23c5a375fdda88f9551a9199be42d6c46cfdb2390a47219a44d41c780b89d712d92feaeba1fe5e89b39cbcd97f05464cc4b092d433cea430ca589018404f33501029f5698ea27816df32f2910b018712e7218c71af2877", @ANYRES32=r7, @ANYBLOB="040000008000030058011680600001800c00090004000000010000000c000400010000000900000014000b008200000000000000070000000000000014000a000000120000000000b6040000000000000c00030007000000090000001000060001000000ff7f000004000000200001801000020000000000120700007f0000000c0004000700000007000000540001801000020000080000f3000000030100000c00090008000000010000000c00050005000000010000001000020009000000b1000000050000000c0009008d000000060000000c00070007000000050000008000018014000a00ffffff7f000000007f00000000000000100006000100000005000000ca0000001000060006000000020000000900000014000a000180000000000000000040cd0000000014000a0001f0ffff00000000f7000000000000000c000700900000000200000014000a00fcffffff000000001000000000000000"], 0x178}, 0x1, 0x0, 0x0, 0x4002}, 0x48040) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4, 0x70bd2c}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r10) r11 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r10) sendmsg$NL802154_CMD_NEW_INTERFACE(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000a40)=ANY=[@ANYBLOB="1400000098df58ba77d3907c3e73fe63fda51c1577f2a2c288aaea9f74b4de7ec7a1f23da382558532c2bae7a320e3ee0294cc568fb8ddd400326223af2d170f628728304f4b58a208cd6f73eb0e9629460511868bc85ad95c5f5b11708c46b0db67868d08d1c323d761de43e914b0dace8626121650dd5d96a12287902009b9865f27f866c4eaf156d0bb6e34d0afacfa668c3d0ba3aab49d718dbcf79ffe44f59c2012e0fa73aa6253b90feb614c9e243012afed445a9611295cbd47e615ce67", @ANYRES16=r11, @ANYBLOB="010000000000000000001c000000"], 0x14}}, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="554b0000000000000000080001800600010000"], 0x28}}, 0x0) r12 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x14, 0x30, 0x53b, 0x70bd2a, 0x0, {0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$ipvs(0x0, r12) sendmsg$IPVS_CMD_GET_INFO(r13, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="010029bd7000fcdbdf250f000000080004000100008008000400530d0000"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4010) sendmsg$IPVS_CMD_SET_CONFIG(r8, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000900)=ANY=[@ANYRESDEC=0x0, @ANYRES64=r13, @ANYBLOB="020035040000fbdbdf250c00000008000600080000000c000180060004004e2400000800060008000000"], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x40) executing program 1: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f0000000b00)="9e17c2977a7873aee9") bpf$PROG_LOAD(0x5, &(0x7f0000001680)={0x1, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="b7000000f8000000bfa300000000000007030000f0ffffff620af0fff8ffffff71a4f0ff000000002d0a0200000000001d400200000000004704000001ed00007b030000000000001d440000000000007a0a00fe00ffffffc3030000e10000009f040000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d66a77ac8daab82167606068067500c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923030000000000000014e72ba7a54f0c33d39000d06a59ff616236fd9aa5b4e377184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049ef6a989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7592566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270fa3d0ee281eaa11ad47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42e54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65807ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91c11ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6cb5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cdb70f617af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028af0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00672f0814bf895e3a6dfbc711243f58a817895f5c4eaf7de8411a831ef65508f416ae3fd1db8386f6aae40515273adcff6196bb45476ec0a5279ed223f772aee25947b1f0d275c0e495b050f10a0b5d19b578a2b4096b9df527211bb39a29224c34a517dc344a195697b0c158d3519c04fe7621ebeef0bc369a1431a90c4117bdfe358e0e869e9f3e5443813261c1c3c78ab2584603e4468de7d0dc93691491050666f4ea5f083a1b281ed230569921856befe07538fbf33f43fa4ad583867bee301ae1e2566ae7a7afb7fc54895a2fef928d91a162affb4d373c7628a2871d7d19eaf06ed5f58f799c8ff391d3752b115073702ee257ade173dd2f736ed5939f219ba42f7650b9a262f6ee4af52aba3e669a835555ea1674f89d7f98ee1a1c7f977e0a93fdf91606d01c1a9dacfd4328502948bed0bc9514e4f66846bc1f245aa5abad88d56679092fee01007cade7ee72a49a498d51a26ba5cf0896cd9143d457262976f682bf31833ee99b5301f349dd2815e76a8b9a6cec5e000bd6bdafcb9536379b6cd0351cfe345abb1f1bce4d15a3f8b2bb447249a6cc5d201a"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x28, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000200), 0x8, 0x10, &(0x7f0000000000)={0x2, 0x40000, 0x1, 0xe}, 0xffffffffffffff7d, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x2, @void, @value}, 0x15) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000180)=0x2, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x200, @private2, 0x5}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x9, &(0x7f0000001a00)=0x1, 0x4) sendto$inet6(r1, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) r2 = socket$inet(0x2, 0xa, 0xa22) setsockopt$inet_mreqn(r2, 0x0, 0x23, 0x0, 0x0) setsockopt$inet_msfilter(0xffffffffffffffff, 0x0, 0x29, 0x0, 0xffffffc1) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = socket$unix(0x1, 0xfd407b1c7cc76f1b, 0x0) bind$unix(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x400448de, &(0x7f00000000c0)={0x4, 0x8000, "e30022"}) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r5, &(0x7f0000000040)="05000000010000", 0x7) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x0, 0x10, 0xffffffffffffffff, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) r6 = epoll_create(0x800) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r3, &(0x7f00000001c0)={0x10}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000140)='contention_end\x00', r3, 0x0, 0x4}, 0x18) close(r4) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000500)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='contention_end\x00', r1}, 0x10) ioctl$sock_SIOCGPGRP(r0, 0x8904, &(0x7f0000000080)=0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r3, 0x6, 0xd, &(0x7f0000000000)='dctcp\x00', 0x6) connect$inet6(r3, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) getsockopt$inet6_tcp_buf(r3, 0x6, 0x1a, 0x0, &(0x7f00000001c0)) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001480)={0x14e8, 0x2b, 0x1, 0x0, 0x0, "", [@nested={0x14d8, 0x4, 0x0, 0x1, [@nested={0x13e0, 0x128, 0x0, 0x1, [@nested={0x1c8, 0x16, 0x0, 0x1, [@generic="a853c9b8abcaf8170bdb47e4629fc3268596303ed2c6b8296f239889391b18dfdcfca64bd04a34bb0a63a7042959100da17c2ccd422cab9f593dc6159a179957783ec1a03e590d77a949200970f35372cd9648314a4938a89e06afe7235c4d166686db14ebf9779c16a76a42f9ec292df0d99c0734f843551096e3b1f73b52b82e9990c312777186ba52af78f4cbfdce6d17224aa8f79ea52af292e4c2a495a24b5cbaaed76c978e67174e3f6f30587fb88bd0bf", @nested={0x4, 0x5c}, @nested={0x4, 0xad}, @generic="265a0a4b0285246634b2d158744a61fad62b3221c539dce88c5260d51237ffe80a67bdd5d070234c1a736e4994fafcfd77a0b89e4edbfc23060ad4a2aae01cf8e5076d5f48ccd6879166dfc05a95308898ca3512b2f94634454bf6a9ea79da9541484df8a2e7c2fffa5fbe095cc4ae6f2a4c1c2fba2368afb1f1187662bec18722d278dac036fe8e197c1a2d8b81f9060831fa1241cd895d88509d31c02443a4b9bf891d9915e552d49343974a97a411650f360399eac84df45a177b0e920fa6e75cbf14d7cf2161c1984361157cb0161cfe6330b34fcbff92adb1d574ed75349338175f62eadd68da3b41a27d37e509", @nested={0x4, 0x23}, @typed={0x8, 0xd7, 0x0, 0x0, @pid=r2}, @nested={0x4, 0x80}, @nested={0x4, 0x30}, @nested={0x4, 0x3c}]}, @nested={0x5c, 0xa1, 0x0, 0x1, [@nested={0x4, 0x147}, @nested={0x4, 0x26}, @typed={0xd, 0xeb, 0x0, 0x0, @binary="03957bb9c8d9de7a49"}, @nested={0x4, 0x5d}, @typed={0x13, 0x29, 0x0, 0x0, @str='contention_end\x00'}, @typed={0x14, 0xc, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @typed={0xc, 0xa7, 0x0, 0x0, @u64=0x5}, @nested={0x4, 0xd8}, @nested={0x4, 0x12b}]}, @nested={0x53, 0x23, 0x0, 0x1, [@generic="2c26403fd5fed6780d7a6f39428c821feda3698ecbf979e49a14383b4cb7855c11d281", @nested={0x4, 0x136}, @nested={0x4, 0x137}, @typed={0xe, 0xcc, 0x0, 0x0, @str='syzkaller\x00'}, @typed={0x4, 0xf5}, @typed={0x8, 0x131, 0x0, 0x0, @pid}, @typed={0x8, 0x4b, 0x0, 0x0, @u32=0x2}]}, @generic="5007e2d17299b2339b67c16a31004deeab47d6790110f3bca701eeaec10afcf586ab5883fe01a9973bf18fe8dc8edb10dd625479455bb903e032262bd1cefb99bc7d476d240bb2e7d78aaa4f0948977b4e43e41ab037c2997a00742f67f2e28aa5f87c63fe40698988b4e59b0c5bab3a", @generic, @generic="3f6e86e5e08f4599fa6bedbeec4a3ea26bd69816dee6100a171403ab4ff8b9199535d50727f78966ce0e7b25f5d563a00dc602412265d66c0cdcc800ca910bc738b220c9aa6a230d9c81b1d196e169482cb7f5e95b8d5fe523014a08de71dcd22b07667e9b08e78cd6fd226b26ce3721fe480f27fbe3430c6d9abfe0f4dad6999d2a6d5eb91f004fbedd730b1d397afaee", @generic="feca4d8690c2491a0c086f25f27a2bce0cc898f4de62f28269b45923edb4fb9b91bc6978d29af2b0434766d348b00f620f69761b5071760d4df6cb0ef62c4e46216cd48fadfd5592091c313ffe602a8122d7a50946ee2b6d3aa90be7b95d52", @typed={0x4, 0xd1}, @generic="309f64e5392584b66624919d4f257a3e4865f6e3597a3abb2a59ad497cd17add4b84d4ab3d611216ee267385be0f179d8e597f7edb3df214ef238cf3e28d665258d4259736553927bd642e918c1e9850503a08ca4cec42aef309921c7893e4ebe1f041b427472e70481d47daa8a315e1edd54a730ef6eac6d5b499309ae3e2245f362ffb91c9ab91629e7973d51500433e2f71e95c7e0e453e62cc4626897607a768dfbcc1f2b95e37ca5ba76a10549b7136891967336cc2565a005167151d312ec7b515c27efb946f7d82a6633e8ff321bcaa1ba952770d94b74faaa7511714bb504d9700fd0538637bb5e4739ac8ecec54d7f3f8f13601e73cb9fea4615e4025b331b4079d3f6480c35df1f2db641c060c2e3ff61787d92fac7f4aa13058a1691a33f17c16f882294f655f31535c252d54cc6c278ca5f6319e5e351e38108ccdf54b620980356e77ee64f67d6b424cee642fd0d2db34d8cfc7f66d00120379e095d303363aab2ef831acfdf211a9c3d2f2fa59c82bf37d690137dd0f7daa3cd8763b18828a1cdf9b3955a7f79d25048935a33bd75aca76236d65b226f5dfabae613d0e6a0e50a527a7abf8fd1c73d295064e03bd0bfa97d0139d87aed18ef0a359c260168a9f93908d7cff99763c181571d423b0815ff06f46171fd1d09c4813210b69f91d5d95470fb13dba7bb116de09d7de594a181240d2a1a85e9f68d4b48549b555eb739fb5405fa7b29ffcf0fd8e2b034ef94d82ace797a6a2023e73857c287fb16d24d4cffbbb7677ef76790e3daae1eed2a8029e5b8f63c05bd57efdd35e135b52f9e09f3c85179270af01b2840762f5157dfacabf4904690a8a73ec524968f657919bfd606545927a514cded6792c7e71f6d688a67b28cf6deff447a69e38bbda42e1a4dc86f5ec271b399558f51756749f0b03282c38355ef07dd9afcdda91118287da51fff2d0be462fe5b62c8afbadbc43aeb9c3238be20754c2d7ba754aeb7c43b517ee452bc3b27bc5edccd157005075472abe17e27c9b9b4e446d65ec5b12c28ee9b9ec35d114da78850a68e807629bf71355d8c73183587ebdc598d013a94fdd9c790cb8b33ada0a3e9eb0e9c2adc9fab692c7bccfd12ab8b3a4ed824a8ebdff2e8efae531f55f2f3098d2d1297bb98c1fa562c88e0332c95bd5aadef40b0b7e533f02fd8848c2d2d4c656049153e01d593b2978f1b1d4b5e4380e00357afebe28b13cdfcd26907f1a913f807e31c1487dab0675ea1cba6612c8f64276f31f25ed06ac7c2b931c481412c5c460d1737f0212a52efcb3e82ee1baff978ce217f9671faaa478aadee10880a0b5c6ea514fd0beff04d33727c5b8ba62c5a6dcb5745ab6b63534a5d947bd3083a13e69e645ecf5fdc3d6008bf201064e5c73e0ebae9dd2b5b4078125d0f28044c0b7d1362ff49be0e2147cc23cb694757638ac8943a20b53f43a03185eccc083a4cbaa79627a2428dd46a3dd33cd9fb53a89553e5777b52c3ef8e8e69c8cd6546fe23afd03164d5fcb827a09813b9991ef2fbec2c83d5d5fde79a5e23ba03a2ff4f6064bde20fc9da1665cfd471b8a1c41783109217c01eec975e1af63e0e887084db726e556ce533e1d41ac0da89943ada45301bc03f422f5ec632af810f3b7c8eb79927ab551c70851aa90efa6276d17be4071b0051aa516ddfe666c3644b0151487add6436b88b52eeb97302b7176f74661e7b2b416517a552016fd3ee538d4bb7d645cf08386242429ec7fe5f5eb5ee31f0dc3cbe2e125de0f96e3e8185cc3fb7ee314dbd50713a4855ad49ecc1255423fac872fe66c9f2943627969419022337c5b4307c69635fb8fc5ef19420b6f210f609150bf4feb90c269cbff9ff6b68afe9d69158e97a8d994372a09f2c2b081a4c9e7bd038231df5df38f8ca3819852cbb5d51e16249061d1239f01390b429d46e3e8582cb450db40673ce6cc73deef412bc0b444bdbd9a9f996208ce6ad1960bb7547451b485347d71dca57a6b6c285edf206266bcb1f91e2d86cdbbd2abd3f7f7e6b9b74f4f50137d65b6fd2bfe6b9f5dcbeb2f9396c8b2b34aa54544e58f1345d5877f4b56dbbe6bb1c26bf1f42908aa655dbb8c3c97108629c53428afc8dba252639cffb1b841720192aaba4b2f579f10d57110ded8c63e779ee8afe8a612774a3385797fbe836762553e81d840938e7d462feb40d750081a33cb0636fee9f1b6fabdfbcbdbd4d6831f9de349d807544d864e8225eb1bb56ad14efb699676ad3a3bca439f29fe6529ab4eb27a81b7d4be829de597aea299aa23011aba45dc0e57e1710a5f947a30f06085ddd6ed17a95d0c800afbf4b97334db9b06fc342e99a375e082b6a5803c26385d3d4c0c940ecea2d41c36ff3efeac76366a9a2aea261d7dc1443556db5acec0fdafc9b11fd518e25759b5ab4e5b99efd23fa43075c0daccd9f80878771694322c4d929db6f99ca4dbbe699887cb134b051896472ac4ad5980b078a0c108971d7cfc13295a5557a42aa5515c4931192800c2788ca107a42a7b87eedd3e3374bb4ffdc46f53e9bab6bb3ba76b55b392d4cb36c83a2845439398a94160ed4d47006ca0c2b36345e13980e220f5c854bb780bfbc768e6ca202f6873613581ff9e832e12f6e7798a880f42dee72583d303f6bda3f4b92e3f03a5ef3c0eda101b02ebb3244d36a01f151e78a705ee5a694a336bf4ffe54da9fa1d5c6c9abe5d8473d3d25191fbd197ae310d895b4addab4518fb0dbff1d67bcbd12505fc93f3cd8a50f8cfbc66e0c04433a252a6077a7a5b07cc3f4d0f95082e4597a834f6138a416563b02ee55b35751e8a9792a811d91e639dfee39d540b6ded5960f3e70964718db77240f4274a26131632aa97cd48d652f028d00a21400f0ff37af664d9aee71654ff2d17ea6cf2d3bd124fa09189d9b900358dd8b529713a02121666d60776fec6c05fd0e48da3ff20d44151e717137b281b689d56b5a97e38329a6267c9e76632572a1e08f7a09140474c2873f99e863316b8095fc4be0e88c29d6b8ce628417796e48748ab8632902f135ee32b4fcef1ea223628561ad31a4482dac5dd89e716b5cd06399a2f48a08158b673c855c2cf3be808a80cd27975adb25aaf065793ca758f77c595fe69b7bcb39e2d9df18c6bb215997438a2b63e01e720386bdbe0e5a22c64b8f314ae4f929dee694765dd6c60e55c7fffab55a1403d13e437127ba1e90b78ac22ae410a8f6031e5b6daa8f7529c2b1b44c8e8584c8885f19c09d302b9d9efe039236768a92544c0729eb955f82fa3d8c539cccbc68ac6b725bb060792d344d151ce4cf96caa9e32e9537b175c088a9592e724af9975035a7e3490783b44c3f3ae59d423898fe39380f1e729abe3cc25ac211c182e248b5ce8b4ed83f8860cf31a7b7a49302df21e1fbbf47840d10ccd8b3f1edcd29001ac2a2bbb6fb39e857c098f9ab63a394a2f815694e2de1eb3d159c998bc02b6dab5114c83d4c5236293311c15585cd2362db3fc1437be2fbdb7c83aeda6c597c4ba2f88a5b0b8e9b5b88a561a5d43f0418a829e47d5e488790db211701bea51fb72dc1b372efe5cb7f42d31b8dffc8b1abe2a500e8960dbe1f477f4d347062253ff7007d278b4b87deb5f786a3bfe5303004da3d5124fc96ff70e7eba109d9f39ce01d8026a84de8bd94de4c3645e6e9ca0d5895804eb30274f3f3e27adec53b403a3770aed58512fd4bca5fd565a30434b30d124b84846650303be4d4e19ee68927b9746e756c3ce381880df2e68cfb51435a2b52311d03b3564547d8c609604fa941d81b5d711b699718a5ff31e247718c0a653d7d751f53b2687c8cd509da11316e789eb0dfc26ab72eb0adf082a2ad354987f9a8ccf8326513fa5d8f5c85e1d56f474ab1b4677693dfbcb1dba247bef09fe7a8fd3ef110cd35e705fe01eb51f1369b5fca2ebc2133dfbb1f273a1c4c3c89fea73170604c3c6a7a66692563b2116bd1a8418d8a076f2e1ab90fba450f1f0fc72858d4d2db58e16b66b221e8c6fdb2e89783fb382620cbdce4dad8b098134de456250e15d8a84a38504a17252d4b3512a420f63dc4afd8149b70d1e386add4c6e5d8a836c749da4fe4adfdf22df5503d3de9237269f276a27f7745daedb3134ed3e16fa9b9472e54ca5b82f87dad03ba947f655a28d04b14ee937ffc9ed4d1035debe61a64881953af868217ef54d501e8f1c9a44a495faaa525c34312205fe1034cfd921d3cc8e03390394861288421b772198c29da2cb88d505e8e67dd94b6db57c271402a95bd89dadbbd1a51ac46d2e2e586c1b9c6e14ab982a4d3676a84c931a56bc1cddd5b8b3a84d56d6104c73b097799a35e0dcff0338c984ee1d2bf5d9b3d68f69b1e0877128bf5f807a96ad2b6e4306b80ca873fa5c64a80e0d22046e01b8c135737dd8b99ea8fee69c6b0d43be07d58bbb3d838290bc317c24c2da8b1df157543ed1c84fd9611ea972afc42315076fcced07e0fc9ee2df70832a1522a8012f351ee17ac597ad2bb0b4339f711da2d3e9783549ab1455cf5c64294094771ea4e1cc2c5e3a3deb026c6458fe8d2fed3663ee7fec9529ac6caec6720866d5829e4762e348c440c5c7acb94be667f79e123a53acbc6c09b8a8bcb43d652d485cce26f22058e96c0ae27b9b5a0044c633c1868d094ff6c124d4914b6e9c457f249493a3643b65493a3e641eff935a9040012f07e7b4c1ded220ab6e8fe7007f1aa0ec7585b4f4cb96e6dbe392d611202a40cd647cfe4195a3af687ef525801b804fd9167d0753181184bc78c31ea659c4ccfe31256f4c5a636cc68587df244ac3cb9b3261a315d8cbdd473a3f46f263be684a35e962c4f42a530fa6e435517043bdfde2a373031b2a51bb9f0ca354d62b643bf2ec2f2850a12e5f8ef996ef527a2c588dfe3aea1d672983ad8e6c50f75368a26215e36c597555dfb9d3b588109c62d307ecc9cb744c8bc1b19a509b9efc21c5b28adabd21efa1f8e0a789fc629332841fa052759b909378f85d855c82eaead3d8400a8fe835f7308bd038bea66d7b431cc801b818401a21e169fdb8e0c4c8298d4eb7989a7a5c43632f346333b114cebd0b21b85564e5a9ed8a07089841b742b7fe5abaddb114bf2650475338342de9283d19abfd6649ca2dec2354d9879ceb472b29a07e6648fa64c45739fd15e0a9d4e9d91899b1397c13f938769de4f9ab773164dcde5dbafb723018fac9f3271a2abd5a8a8453aacda5530fa39477fbcaa6569dcf67c3385fdda37aa40d9761d8b9cba5cdd04f87cbcb9c3c54f62705e8951080caa74ee44d4588198a424fa7a7742b64bdce771fc88f7df6cb9080694fdbe8e867ae54bc0fecc7bdf99dcd313fa72d4f726a4d9f552c7f18a69f367dabba684b66ca6aecf7a238f1fc7a27ccb6ff377b477aeaa25c888a5d68acddd06ac2085d2b6484eee193ead0d33a7e0c2b0cd612f85d6226168e49972c0146eb677b7a772a71fd2199e653b850646768a96210e7c6c4c02daf1a27950d86fababbf27834dbd0d1f89438c932a3786d1a3f50839072dbbccb66f9f81ee77aff44e89189abb7ebba5ca80cfaf9b8903ed06e302b263073c4389e8d4841382409c08c9628fef02d33bb28c3cbd42a24e3501147aeaab6e0eb80b123fc4ad468d99692fd2817ff303d160d53aac18718c2c3384a3925599684951e8c8c7b7d48aa99dd90d6ef59e72287c6acc4ce670e4e7d4bf24eeb0391000f5b1b8f1c93250109242cd655a01398ad2e4e"]}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@loopback}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8cd1"]}]}, 0x14e8}], 0x1, 0x0, 0x0, 0x11}, 0x0) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) accept$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_HOPOPTS(r1, 0x29, 0x36, &(0x7f0000000040)=ANY=[], 0x8) connect$inet6(r1, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_GET(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x3c, r3, 0x1, 0x0, 0x0, {0x35}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x400d5}, 0x0) close(0xffffffffffffffff) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r1, &(0x7f0000004b80)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000000)="82", 0x1}, {&(0x7f00000000c0)="8484", 0x2}], 0x2}}], 0x1, 0x4400c800) sendto$inet6(r1, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000ab4000000060a01040000000000000000020000280900010073797a30000000000900020073797a320000000088000480100001800c000100636f756e7465720014000180090001006d6173710000000004000280600001800a0001006c696d6974000000500002800c000140000000000000000808000440000000010c00014000000000000080010c00024000000000000000090800034000000fba0c00024000000000000000000c000140000000000000000714000000110001"], 0xdc}}, 0x0) sendmsg$NFT_MSG_GETRULE(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="14000000190a0102000000000000000000000000ebf5622b060676179bf02a5ca21c9181166a3e561614e54b27d2d16a66c28a808c576265bf5f436e151a08954809c2722084ed8ecfed53615b50bdf78b4a1f5f030efadd9729a5e08439786be6f3ab759e1813b9e146f3a092a05cce"], 0x14}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001640)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x28, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x4}}, 0x9c}}, 0x0) recvmmsg(r0, &(0x7f000000c2c0)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp_SCTP_GET_PEER_ADDR_INFO(0xffffffffffffffff, 0x84, 0xf, 0x0, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x34, 0x3a, 0x9, 0x0, 0x0, {0x1}, [@nested={0xc, 0xe0, 0x0, 0x1, [@typed={0x8, 0x5, 0x0, 0x0, @u32=0xf}]}, @nested={0xc, 0x1, 0x0, 0x1, [@typed={0x6, 0xb0, 0x0, 0x0, @str='!\x00'}]}, @typed={0x8, 0x2, 0x0, 0x0, @ipv4=@broadcast}]}, 0x34}}, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000780)={0xffffffffffffffff, 0x18000000000002a0, 0x0, 0x0, 0x0, 0x0, 0x23b, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000001200)=[@in6={0xa, 0x4e22, 0x8, @loopback, 0x6}]}, &(0x7f00000011c0)=0x10) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x40, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0, 0x0, 0x93}, @IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x3}]}, 0x40}}, 0x0) getsockopt$bt_hci(r5, 0x84, 0x81, &(0x7f0000000080)=""/4076, &(0x7f0000000040)=0xfec) socket$key(0xf, 0x3, 0x2) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) executing program 3: r0 = socket$tipc(0x1e, 0x2, 0x0) (async) r1 = socket(0x40000000015, 0x5, 0x0) bind$inet(r1, &(0x7f0000000340)={0x2, 0x0, @loopback}, 0x10) r2 = socket(0x15, 0x5, 0x0) getsockopt(r2, 0x200000000114, 0x2715, 0x0, &(0x7f0000000000)) bind$tipc(r0, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) (async) r3 = socket$tipc(0x1e, 0x5, 0x0) syz_emit_ethernet(0x8e, &(0x7f0000000380)={@local, @remote, @val={@void, {0x8100, 0x2, 0x1}}, {@llc={0x4, {@snap={0xaa, 0xaa, "a6", "1e63b1", 0x17, "854a2c9eb0e75f511eee29e2d3bdc698f953ffe476ddeb16c495930520120e52a6564849a2b01c197f80b34bd352951c14417c7c195be632824bac5890209b590a32c05a809905bafe6182e2ca2fed36074e8ff21d8265bd8071998870732631558773ec9bd63c8cdd1065ae500811642ed42abe"}}}}}, &(0x7f0000000240)={0x1, 0x1, [0x349, 0x5fd, 0x1c0, 0x563]}) (async) bind$tipc(r3, &(0x7f0000000100)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) openat$cgroup(0xffffffffffffffff, &(0x7f0000000080)='syz0\x00', 0x200002, 0x0) (async) r4 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000000c0)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x2a813, r4, 0x0) (async) preadv(r4, &(0x7f00000015c0)=[{0x0}], 0x1, 0x0, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x9, 0x3, &(0x7f0000000200)=@framed={{0x18, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x7}}, &(0x7f0000000100)='GPL\x00', 0x2, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x22, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r5, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) (async) ioctl$sock_inet6_tcp_SIOCOUTQNSD(0xffffffffffffffff, 0x894b, &(0x7f0000000040)) (async) r7 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r7, 0x11b, 0x2, &(0x7f0000001980)=0x100, 0x4) bind$xdp(r7, &(0x7f0000000100)={0x2c, 0x9, r6}, 0x10) (async) bind$tipc(r3, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) r8 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000000)={0x0, 0x6}, 0x4) (async) setsockopt$packet_fanout_data(r8, 0x107, 0x16, &(0x7f0000000100)={0x2, &(0x7f0000000080)=[{0xa4}, {0x6}]}, 0x10) (async) setsockopt$TIPC_GROUP_JOIN(r3, 0x10f, 0x87, &(0x7f0000000300)={0x42, 0x1}, 0x10) sendmsg$tipc(r0, &(0x7f00000006c0)={&(0x7f0000000540)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x10000000}}, 0x10, 0x0}, 0x0) executing program 3: r0 = socket(0x2a, 0x3, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_opts(r1, 0x29, 0x4c, &(0x7f0000000540)=ANY=[], 0x60) sendto$inet6(r0, &(0x7f0000000080)="7800000018002507b9409b14ffff00000202be04020506050e130204430009003f0020480a0000000d0085a168d0bf46d32345653600648d27000b000a00000049935ade4a460c89b6ec0cff3959547f509058ba86c902000000004a3200040016000b000a0000000000e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), r0) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r0, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x28, r2, 0x200, 0x70bd26, 0x25dfdbfe, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @empty}]}]}, 0x28}, 0x1, 0x0, 0x0, 0x854}, 0x1) sendto$inet6(r0, &(0x7f00000001c0)="020ff3c63a9fae7a920057af134180ea10fb88e703ae6c10ad7b3106544060587d87aba5c8fb2bfcaa68ea68cbc8c820d42da8c13a4040e9485b54bffdcabc88ba33fcd13806c9fcc0645ee4a730cc89dd039f8e70fda358d11ab43cac3fd9340a497c0c2819b37c77e7845a406b485ffbcb6899a864d36ec06be2bcaccfe9797cfb3af4b22d0c0afedb56dcf802b703bdba96fe69abffe300cc76c8a55735024fc7f662e5d1845abefbcc98f34c041d023f211c5f659c5e7401a09a58f64cd30ef2c79001582f7ab3e0db06984b976383", 0xd1, 0x80805, &(0x7f00000002c0)={0xa, 0x4e23, 0x7, @empty, 0x6}, 0x1c) executing program 2: r0 = socket$inet6(0xa, 0x3, 0x6) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f00000005c0)=0x7fff, 0x4) (async) connect$inet6(r0, &(0x7f0000000080)={0xa, 0x0, 0x380000, @loopback}, 0x1c) (async) socketpair(0x28, 0x4, 0x233f, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000080)=0x14) executing program 0: r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, &(0x7f0000000000)={'filter\x00', 0xb001, 0x4, 0x3c0, 0x0, 0xe8, 0xe8, 0x2d8, 0x2d8, 0x2d8, 0x7fffffe, 0x0, {[{{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x20, '\x00', 0x0, 0x2d8}}, {{@uncond, 0xc0, 0x100, 0x0, {0x0, 0x1e03}}, @unspec=@ERROR={0x40, 'ERROR\x00', 0x0, "2c3bb27d9d5b379b853c7744b526e29755ec721db80fdb00f95f8a608b8d"}}, {{@arp={@initdev={0xac, 0x1e, 0x0, 0x0}, @remote, 0x0, 0x0, 0x0, 0x0, {@mac=@broadcast}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'pim6reg0\x00', 'netpci0\x00'}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410) bpf$PROG_LOAD(0x5, &(0x7f0000001780)={0x17, 0xf, &(0x7f0000000240)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x5}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000040)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x5, '\x00', 0x0, @cgroup_sysctl, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) executing program 3: r0 = socket(0x2, 0x3, 0xff) sendmmsg$inet(r0, &(0x7f0000000d00)=[{{&(0x7f0000000300)={0x2, 0x4e24, @remote}, 0x10, 0x0}}, {{&(0x7f0000000780)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10, 0x0, 0x0, &(0x7f0000000840)=ANY=[], 0x18}}], 0x2, 0x0) executing program 4: r0 = gettid() r1 = syz_open_procfs$namespace(r0, &(0x7f0000000000)) (async, rerun: 32) r2 = socket(0x2a, 0x2, 0x0) (async, rerun: 32) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={{0x14}, [@NFT_MSG_NEWRULE={0x30, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x18, 0x4, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @target={{0xb}, @val={0x4}}}]}, @NFTA_RULE_COMPAT={0x4}]}], {0x14}}, 0x58}}, 0x0) (async, rerun: 64) sendmsg$MPTCP_PM_CMD_SUBFLOW_DESTROY(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="000000000000000000000b00000008000300000000000c00018008000000", @ANYRES32=0x0, @ANYBLOB], 0x28}}, 0x0) (async, rerun: 64) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000001ac0)=[{&(0x7f00000003c0)=ANY=[@ANYBLOB="140100001f000504000000000000000004"], 0x114}], 0x1}, 0x0) (async, rerun: 64) getsockname$packet(r2, 0x0, &(0x7f0000001480)) (rerun: 64) socket$packet(0x11, 0x2, 0x300) (async, rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) (rerun: 64) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x801) socket$netlink(0x10, 0x3, 0x0) mkdirat$cgroup(r1, &(0x7f0000000000)='syz0\x00', 0x1ff) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x8, 0x3, &(0x7f0000000000)=ANY=[@ANYRES8=r3], &(0x7f0000000480)='GPL\x00', 0x8000000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) executing program 2: bind$rds(0xffffffffffffffff, 0x0, 0x0) (async) r0 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$netlink(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=@ipv4_newrule={0x1c, 0x20, 0x301}, 0x1c}}, 0x0) (async) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) (async) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000000), r3) sendmsg$L2TP_CMD_TUNNEL_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000040)={0x58, r4, 0x917, 0x0, 0x0, {}, [@L2TP_ATTR_PROTO_VERSION={0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0xfeffffff}, @L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_PEER_CONN_ID={0x8, 0xa, 0x1}, @L2TP_ATTR_IP_SADDR={0x8, 0x18, @local}, @L2TP_ATTR_IP_DADDR={0x8, 0x19, @multicast2}, @L2TP_ATTR_IP6_SADDR={0x14, 0x1f, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}]}, 0x58}}, 0x0) executing program 3: connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @multicast1}, 0x10) (async) r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='blkio.bfq.io_merged\x00', 0x0, 0x0) r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), r0) getsockopt$inet_mtu(r0, 0x0, 0xa, &(0x7f00000000c0), &(0x7f0000000100)=0x4) (async) bpf$LINK_DETACH(0x22, &(0x7f0000000140)=r0, 0x4) (async) sendmsg$BATADV_CMD_SET_MESH(r0, &(0x7f0000000240)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000200)={&(0x7f00000001c0)={0x2c, r1, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_GW_MODE={0x5, 0x33, 0x2}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0xa0}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000840}, 0x10) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000280)={0x1, 0x0}, 0x8) r3 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f00000002c0)=r2, 0x4) bpf$LINK_GET_NEXT_ID(0x1f, &(0x7f0000000300)={0x3}, 0x8) (async) syz_genetlink_get_family_id$team(&(0x7f0000000340), r3) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r0) (async) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(r0, 0x89f0, &(0x7f0000000480)={'sit0\x00', &(0x7f0000000400)={'sit0\x00', 0x0, 0x8, 0x7f81, 0x6, 0x180, {{0x15, 0x4, 0x3, 0x1, 0x54, 0x68, 0x0, 0x4, 0x4, 0x0, @broadcast, @rand_addr=0x64010101, {[@noop, @lsrr={0x83, 0x7, 0xa5, [@private=0xa010100]}, @timestamp_addr={0x44, 0xc, 0xa5, 0x1, 0x7, [{@broadcast}]}, @lsrr={0x83, 0x13, 0x73, [@multicast1, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010102, @rand_addr=0x64010102]}, @timestamp={0x44, 0x18, 0x95, 0x0, 0x2, [0x8000, 0x6, 0x4, 0x22, 0xe]}]}}}}}) (async) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f0000000540)={'erspan0\x00', &(0x7f00000004c0)={'sit0\x00', 0x0, 0x8000, 0x7, 0x529, 0x85, {{0xd, 0x4, 0x2, 0x0, 0x34, 0x64, 0x0, 0x7f, 0x4, 0x0, @local, @empty, {[@generic={0x88, 0x3, "aa"}, @noop, @cipso={0x86, 0x1a, 0x0, [{0x5, 0x8, "12cd51f2018d"}, {0x2, 0x6, "5898bb03"}, {0x1, 0x3, "b9"}, {0x6, 0x3, "d6"}]}]}}}}}) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000580)={'batadv0\x00', 0x0}) sendmsg$ETHTOOL_MSG_FEATURES_GET(r4, &(0x7f0000000700)={&(0x7f0000000380)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000006c0)={&(0x7f00000005c0)={0xd4, r5, 0x400, 0x70bd2a, 0x25dfdbfd, {}, [@HEADER={0x4}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}]}, @HEADER={0x90, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_hsr\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_macvtap\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syzkaller0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xd4}, 0x1, 0x0, 0x0, 0x4000}, 0x4) (async) r9 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000780), r0) sendmsg$TIPC_NL_NET_SET(r4, &(0x7f0000000b40)={&(0x7f0000000740)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000b00)={&(0x7f00000007c0)={0x328, r9, 0x510, 0x70bd29, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0x10, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_NODEID={0xc, 0x3, 0x400}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xef1c}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x3945}, @TIPC_NLA_PUBL_TYPE={0x8}]}, @TIPC_NLA_NODE={0xe0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x81}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x4}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7fffffff}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0xfffffff7}, @TIPC_NLA_NODE_ID={0xad, 0x3, "2267fc5a0a2e3f17057776f797281c3016432ae67f3087f36b8a6c7d2774658d4f85b95fac8d6ba12a2e6bbd121156b15204862858b6c2117041edd9dec41e869173a38b691119c18bdd66ef7cb58902b34843af067dd55beefd8fdbd6dda99fcf92702142226dbb9be2e255f333788f73b50568eef268f0b6ccf32fa17b3e96db498ac2ee4c58fefd09358f4b9688fbd159896fef1540eca062a8c8aa4a3d458a2b7fd9deec74334a"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x2}]}, @TIPC_NLA_SOCK={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_CON={0x24, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x41dc}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x60}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x10001}]}, @TIPC_NLA_MEDIA={0xb8, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe3c}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xf70d}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x44, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x90000000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}]}]}, @TIPC_NLA_LINK={0x20, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}]}]}, @TIPC_NLA_MEDIA={0xcc, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}]}, @TIPC_NLA_MEDIA_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x10000}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x20}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x4}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x64}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1ff}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffe}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}]}]}, 0x328}, 0x1, 0x0, 0x0, 0x44004}, 0x40000) (async) listen(r4, 0xf4) (async) r10 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000b80)={0x2, 0x4, 0x8, 0x1, 0x80, r0, 0x100000, '\x00', r6, 0xffffffffffffffff, 0x3, 0x1, 0x3, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000d00)={r10, &(0x7f0000000c00)="ee8b3c048295044c1c01715e2e6197b1a5d1dc728db2e3e5b38e82a1267ca3da08649f1f36b16054dbac93c9264d6ffb33caf5404d0b543ecf154bc5663a2289d2db2cd4a115c0114e06bc47a37d9275b40113e79942d7a3fd1cea1621f58ffc72e2e4c82dae9a81bdb7afcccfd2832101fd25fece4e600f4c0cfe75103f6d839ce88744133d69933fa6bf44ab55252f8f22ea56b5ddd813ed6da12d72a1983e8588db54201afc5a2b71acd6ff4c", &(0x7f0000000cc0)=""/27}, 0x20) r11 = openat$cgroup_ro(r0, &(0x7f0000000d40)='memory.events.local\x00', 0x0, 0x0) (async) r12 = socket$rds(0x15, 0x5, 0x0) sendmsg$rds(r12, &(0x7f00000016c0)={&(0x7f0000000d80)={0x2, 0x4e23, @rand_addr=0x64010100}, 0x10, &(0x7f0000001280)=[{&(0x7f0000000dc0)=""/41, 0x29}, {&(0x7f0000000e00)=""/90, 0x5a}, {&(0x7f0000000e80)=""/63, 0x3f}, {&(0x7f0000000ec0)=""/79, 0x4f}, {&(0x7f0000000f40)=""/201, 0xc9}, {&(0x7f0000001040)=""/163, 0xa3}, {&(0x7f0000001100)=""/176, 0xb0}, {&(0x7f00000011c0)=""/161, 0xa1}], 0x8, &(0x7f00000015c0)=[@mask_cswp={0x58, 0x114, 0x9, {{0x7, 0x7}, &(0x7f0000001300)=0x5, &(0x7f0000001340)=0x2, 0x3, 0x110, 0x7ff, 0x1, 0x50, 0x7}}, @rdma_args={0x48, 0x114, 0x1, {{0x80000000, 0xf}, {&(0x7f0000001380)=""/166, 0xa6}, &(0x7f0000001500)=[{&(0x7f0000001440)=""/2, 0x2}, {&(0x7f0000001480)=""/114, 0x72}], 0x2, 0x20, 0x7ff}}, @fadd={0x58, 0x114, 0x6, {{0x8, 0xa5fe}, &(0x7f0000001540)=0xfb8c, &(0x7f0000001580)=0x7a04546d, 0xdf, 0x2, 0xa, 0x4, 0x1a, 0x9}}], 0xf8}, 0x48814) (async) setsockopt$ARPT_SO_SET_REPLACE(r11, 0x0, 0x60, &(0x7f0000001740)={'filter\x00', 0x7, 0x4, 0x3d0, 0x0, 0x0, 0x1f8, 0x2e8, 0x2e8, 0x2e8, 0x4, &(0x7f0000001700), {[{{@uncond, 0xc0, 0x110}, @mangle={0x50, 'mangle\x00', 0x0, {@empty, @empty, @initdev={0xac, 0x1e, 0x1, 0x0}, @private=0xa010100, 0x4, 0x1}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@MARK={0x28, 'MARK\x00', 0x2, {0x7, 0x8}}}, {{@arp={@loopback, @multicast1, 0x0, 0xff000000, 0x5, 0x9, {@empty, {[0x0, 0xff, 0xff, 0x0, 0x0, 0x80]}}, {@mac=@local, {[0xff, 0xff]}}, 0x400, 0x9, 0x6, 0xea1b, 0x8, 0x6, 'ip6_vti0\x00', 'nr0\x00', {}, {}, 0x0, 0x1}, 0xc0, 0xf0}, @unspec=@CONNMARK={0x30, 'CONNMARK\x00', 0x1, {0x73, 0xfffffffb, 0x8}}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x420) r13 = syz_genetlink_get_family_id$mptcp(&(0x7f0000001b80), r4) socket$pppoe(0x18, 0x1, 0x0) (async) r14 = syz_genetlink_get_family_id$l2tp(&(0x7f0000001c00), r0) sendmsg$L2TP_CMD_SESSION_GET(r11, &(0x7f0000001cc0)={&(0x7f0000001bc0)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000001c80)={&(0x7f0000001c40)={0x34, r14, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@L2TP_ATTR_ENCAP_TYPE={0x6}, @L2TP_ATTR_SEND_SEQ={0x5, 0x13, 0xe}, @L2TP_ATTR_L2SPEC_TYPE={0x5}, @L2TP_ATTR_UDP_ZERO_CSUM6_RX={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x4000004}, 0x40000c0) sendmsg$MPTCP_PM_CMD_SET_FLAGS(r4, &(0x7f0000001e40)={&(0x7f0000001d00)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000001e00)={&(0x7f0000001d40)={0xa8, r13, 0x300, 0x70bd28, 0x25dfdbfc, {}, [@MPTCP_PM_ATTR_TOKEN={0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x1}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xf0}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x4}, @MPTCP_PM_ATTR_ADDR={0x2c, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x4}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x8}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x13}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x14}]}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x5}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x2}, @MPTCP_PM_ATTR_ADDR={0x38, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @initdev={0xac, 0x1e, 0x0, 0x0}}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x5}, @MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e22}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private1}]}]}, 0xa8}}, 0x4000000) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [30, 4, 30, 20, 30, 5, 30, 14, 9, 27, 22] detailed listing: executing program 1: openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) socket$inet_udp(0x2, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="0000200018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000009500000000000000"], &(0x7f0000000200)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) pipe(&(0x7f0000000000)) socket$inet_smc(0x2b, 0x1, 0x0) r2 = socket(0x1, 0x803, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) socket$rds(0x15, 0x5, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000040)='ns/pid_for_children\x00') r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000000000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_MSG_GETOBJ_RESET(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000140)=ANY=[@ANYBLOB="44000000150a0309000000000000000000000008090001"], 0x44}, 0x1, 0x0, 0x0, 0x24000819}, 0x40008800) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$tipc(r5, &(0x7f00000001c0)={&(0x7f0000000300)=@id, 0x10, &(0x7f00000007c0)=[{&(0x7f0000000940)="5763f922081ae50887ede09da114c1daa077f9611f8aa81d1b6fa5f806897377d6aa8524a8b1d8c81597ae6a3411d62b43ead10f470c911e8223cee2d6745ff65b450f8b0b46f900c910f852", 0xff20}, {&(0x7f0000000280)="b57af26468ffde59db204ffaa467c0af523b9e6d93dd62dad3d2f90b45e80eb530982e2a1a0b9ebc2c7113d4f93982f87d0ced6312bdcaa996c13c02d027870ae0bdbed8b104a10605ae3939cfa8e7d4ae5e2f97b5958bed4a4430c01d04f980fac5e88de756ec949e14a35bfb3f32197c05b451", 0x74}, {&(0x7f00000009c0)="3d408cd47846fd99d1d1a4df38e0afdd03a817bf3b4673e575b2c253bae12d98c4d5e4e6d317ba457f2d0de6e1fbc5a43bae0d257cda31fb579139135de49db225bf75a3dea059b4a7a9808dd72eb1bd84d0cf9959907ad6b1e1ec718aa8d5004fd0acd19045d8d6e0f04b6b4497bb3126e4ad0d033ef175a58f55d0993d32bb3a10246c0e9ed8956592d6b51d4c1b3d35b68e6a354f5bdddcb0c943411abe361cd03acfa5d2f09a07700d9ce62314a233dc06de1a", 0xb5}, {&(0x7f0000000a80)="a840c8a67da22f1b2c4e068bb1ad9c499f093b4480b55eb7b9408f5400cc74932ab986ca937640a84378eb6446626516e84b0055936bb61fac109e2624e86903d729b0b10b4f16db7da1fa3aaa808fe333de0c9316c2412cb9ed2d604f8b3fa52416302221487c294ae9dc54783573eb5e7c1027fc39fa60c39afee14fb7cf3e6ef0041470dfd6a4a356a1d7e20a437bcadc7f0b5afa9f9d68bccd88dc02cc0150149950fdf196f5aa69b6c4d17ff0e4f1eb12c021fb1a6ff17ea6cd44b55cae0d9a054286ac6428d5a8d2ec34f045da5e7dbc1f8db2dcc83f53affd659e752b75f3bf443e576a5978614c0ed54741afa3ef7ac2b597143149c19c2fe9130a6f065fa277c2", 0x9c}, {&(0x7f0000000600)="c016c55101fc98bba00b0c2946a2b285871ce0494875c9d8979d34a99a409dcb328a6ff1e31414ec38af8d9348d49550faf55f18c1d9f281054ffbe9a13132e9a05e0542a376762a4d799b6b4f0311f62189f67e7708285a203492767e25e6bc4d28d6d3f8d9f50c2660483f8f942ecb733e84f8619101c2ec2ec357bec450d092e6068a319a9f761d766e6ae151f3f3cb790dda0a6dbc381be1a87e4d992bc55e39f166e65d1a5997bc4d255f00c45f6264f7b459ce6fc78a91f8935fa3aa5fe8be532e06387d82f07e", 0xca}, {&(0x7f0000000700)="f32ced1978f6103c6709573259e317066e84d42f18d090e52035bcf2ddcf8761f30c8179d42f2d06e49766e18561147a88e7ab4a817816b9da02e1744bc7eb653eb04ab70b5bf5111e01923c9bd0f4b72df99f19253083a444b5fbf214a2e9fbbc352a08731643692912aebd09546ccb28837254a30d1e53084dd7f6b7114fa3825fcbae9443ec15fb31bca97a87824d4bc8b632cf971bfb523a", 0x9a}], 0x6, &(0x7f0000000840)="a6d462c399e20d9d7ab19933a9b3d0e1d617be45eb50440e1e51f20cd773cd1b34e2669a511f6292d81a777376560dc1daae580d2419af271bdd485f32ddaa3679178bcbe6ff6f5d5d758535afbe2a930342eaa16108a32d9d31fbfe8bf4d89784440c3ff3fef2f998aebc9634", 0x6d}, 0x80) close(r5) recvmsg(r4, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x101d0}], 0x1, 0x0, 0xfffffffffffffe25}, 0x0) sendmsg$NFT_MSG_GETOBJ(r3, &(0x7f0000000600)={&(0x7f0000000180), 0xc, &(0x7f0000000240)={&(0x7f00000003c0)={0x23c, 0x13, 0xa, 0x401, 0x0, 0x0, {0x7, 0x0, 0x7}, [@NFTA_OBJ_USERDATA={0x4e, 0x8, "cc7bcce700116ac2ae434218d6d6f76d8f020ee10251322a2687b5988e023da99cf9aadc7e65db08816fc4b9810b2bff50c46e06d1827d0b08c8e1d05449b3bff40e32706c79e1a43570"}, @NFTA_OBJ_USERDATA={0x26, 0x8, "fe9b0c3b8bbfa879ced36c141f9e1ff9fda1035413ee351da8b9d0fe02f368053729"}, @NFTA_OBJ_USERDATA={0xd4, 0x8, "bd50fbc045da38f1f3370aff5eb2003235c726f048470c3ce3793535adca73403ee3f9d1e716ebbec342ad1915ef537880986309f7ec817a626a20d61248afe54bc0602882bda3d31848f7ad90dc001df7d8750d61e8cf6283462e69661a3183308b2f4fe5db6bb1cbfa931c893f84315f0620ce1512bc1d1b6b065a36d69aad47035570a39ff113482872d4dec3112f3483edff95a2fad821b647d83bf6adc5b1acf8d25d4cb2525678ff36f600d501880935da17ae4304e16dbb9f81e242bd564835f9b406a3ffc5844a595087ffb5"}, @NFTA_OBJ_USERDATA={0xa9, 0x8, "3bf954990a8fe7afffcd5dbba809acdc2ca3e9801c9c691cbee3bc2834f4cae281df53d29269aebd53e55f13c7eee013116a298a217c16fba3187f8c92f4992ebc4414636a54b122788bdfc477aab683fa9047eeb900c3f62810cd43eba756a61b890c912c68abf4542a06711aea69389224ab71c68cb318ad4c6d90b9fce9f499bd81bcc9e75ac137baecbe762682166dcabab6bc3c5c325ce185124e588e59d4cb86a524"}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x1}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}, 0x23c}, 0x1, 0x0, 0x0, 0x4004044}, 0x4004818) socket$inet6_sctp(0xa, 0x1, 0x84) pipe(&(0x7f0000000100)) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)=ANY=[@ANYBLOB="4c0000003ae16696cfcd61f38f00000304000000003f00000000000000", @ANYRES32=0x0, @ANYBLOB="a5fdad88000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r6, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r6, @ANYBLOB], 0x4c}}, 0x0) executing program 4: r0 = socket$kcm(0x10, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=@ipv6_getaddrlabel={0x24, 0x4a, 0x1, 0x0, 0x0, {}, [@IFAL_LABEL={0x4}]}, 0x24}}, 0x0) sendmsg$kcm(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="2e00000010008188040f80ec59acbc0413a1f8480b0000005e140602000000000e000a000f00000002800000121f", 0x2e}], 0x1}, 0x0) executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=@newsa={0x10c, 0x10, 0x1, 0x0, 0x0, {{@in=@local, @in=@local}, {@in6=@private1, 0x0, 0x3c}, @in=@dev, {}, {0x0, 0x0, 0x0, 0x5}, {}, 0x0, 0x0, 0xa, 0x2}, [@coaddr={0x14, 0xe, @in6=@ipv4={'\x00', '\xff\xff', @loopback}}, @XFRMA_SET_MARK={0x8}]}, 0x10c}}, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x13, 0x4, &(0x7f0000000040)=ANY=[], 0x0, 0x800fc5, 0x0, 0x0, 0x0, 0x8, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3, @void, @value}, 0x94) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r2 = openat$cgroup_devices(r1, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x1) sendfile(r3, r2, &(0x7f00000003c0)=0x4000000001ff, 0x10000) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005d80)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) pipe(&(0x7f0000000000)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x88000, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f00000000c0)={'lo\x00', 0x1000}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000000000000042e67ca8f39352320b318b0766fc6f9373230950f1d71b89d69c6ec4807fa578697a2fe29c36e3aec21422582697b5e8fd5d6046990852aaf668ce4331"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0xa, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000095000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0xf, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) writev(0xffffffffffffffff, &(0x7f00000002c0), 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000000)) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000000)={0x3, 0x4, 0x4, 0xa, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), 0xffffffffffffffff) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r6, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000780)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x48}, 0x1, 0x0, 0x0, 0x8000}, 0x100) r7 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r7, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[], 0x18}, 0x0) listen(r7, 0x2f3) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, &(0x7f0000000200)=@framed, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) executing program 4: r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000040)=@raw={'raw\x00', 0x3c1, 0x3, 0x3a8, 0x0, 0xc8, 0x8, 0x180, 0x5803, 0x2d8, 0x2e8, 0x2e8, 0x2d8, 0x2e8, 0x3, 0x0, {[{{@ipv6={@empty, @private1, [], [], 'pim6reg0\x00', 'wlan0\x00'}, 0x0, 0x118, 0x180, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@pkttype={{0x28}, {0x7, 0xddad}}, @common=@dst={{0x48}, {0x4}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x1, 0x0, 0x0, 0x0, 'pptp\x00', 'syz0\x00'}}}, {{@uncond, 0x0, 0x138, 0x158, 0x0, {}, [@common=@unspec=@rateest={{0x68}, {'dvmrp0\x00', 'batadv_slave_1\x00', 0x12, 0x3}}, @inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x408) (async) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000002304e800000000000000ea850000007b00000095"], &(0x7f0000000100)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000006c0), r2) sendmsg$IEEE802154_LLSEC_DEL_KEY(r2, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000480)={0x14, r3, 0x1, 0x20}, 0x14}}, 0x0) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000500)={&(0x7f00000004c0)='svcrdma_decode_rseg\x00', r1, 0x0, 0x188158f2}, 0x18) (async) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f00000001c0)='netlink_extack\x00', r1}, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)={0x1c, 0x3c, 0x107, 0xfffffffd, 0x0, {0x3, 0x7c}, [@nested={0x4, 0x7a}, @nested={0x4, 0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x488c0}, 0x24040880) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)) (async) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000580)={'batadv_slave_1\x00', 0x0}) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r5, 0x89f0, &(0x7f0000000000)={'syztnl0\x00', &(0x7f0000000100)={'ip6gre0\x00', r6, 0x0, 0x0, 0x0, 0x0, 0x0, @private0, @private0, 0x7800, 0x8, 0x7, 0x7}}) unshare(0x22020400) (async) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cgroup.controllers\x00', 0x275a, 0x0) unshare(0x20400) (async, rerun: 32) close(r7) (async, rerun: 32) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=@deltfilter={0x30, 0x2d, 0x1, 0x0, 0x0, {}, [@filter_kind_options=@f_fw={{0x7}, {0x4}}]}, 0x30}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00', r1}, 0x10) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket(0x15, 0xf, 0x0) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) r5 = syz_init_net_socket$x25(0x3, 0x5, 0x3) ioctl$SIOCX25SFACILITIES(r5, 0x89e3, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$EBT_SO_SET_ENTRIES(r3, 0x0, 0x80, &(0x7f0000000880)=@nat={'nat\x00', 0x19, 0x2, 0x348, [0x20000280, 0x0, 0x0, 0x200002b0, 0x200002e0], 0x2, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="29000000000000000000000000000021000000000000000000000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000400000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff020000000300000000000000ffff0000000000000000000000000000000062726983676530000000000000000000736974300000000000000000000000007465616d300000000000000000000000aaaaaaaaaaaa000000000000aaaaaaaaaabb0000000000000000d8010000d801000010020000636f6d6d656e7400000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000003f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073746174697374696300000000000000000000000000000000000000000000001800000000000000000000000000000000000000000000000000000000000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff000000001b0000000000000000007465616d5f736c6176655f310000000069726c616e300000000000000000000069726c616e3000e575dd73000000000073797a6b616c6c6572300000000000000180c2000000000000000000f646793b7b3900000000000000007000000070000000a8000000736e6174000000000000000000000000000000000000000000000000000000001000000000000000aaaaaaaaaa000000ffffffff00000000"]}, 0x3c0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYBLOB="140100002c0001000000000000000000040100800c0000000000000000000000140001000100000000000000000000000000000150bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c226237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb64"], 0x114}], 0x1}, 0x0) r6 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000700), 0x4) bpf$ITER_CREATE(0x21, &(0x7f0000000840)={r6}, 0x8) syz_genetlink_get_family_id$ethtool(&(0x7f0000000800), r0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r3, 0x89f1, &(0x7f0000000600)={'syztnl2\x00', &(0x7f0000000980)={'gretap0\x00', 0x0, 0x7800, 0x8, 0x80000000, 0x6, {{0x1e, 0x4, 0x1, 0x0, 0x78, 0x65, 0x0, 0x7, 0x2f, 0x0, @rand_addr=0x64010102, @local, {[@noop, @timestamp={0x44, 0x1c, 0xf5, 0x0, 0xe, [0x2, 0x5, 0x5, 0x1a48, 0x5, 0x100]}, @ssrr={0x89, 0x2f, 0x70, [@private=0xa010102, @empty, @multicast1, @multicast1, @empty, @multicast2, @empty, @empty, @local, @broadcast, @multicast2]}, @rr={0x7, 0x17, 0xf4, [@empty, @multicast1, @empty, @broadcast, @remote]}]}}}}}) sendmsg$nl_route(r3, &(0x7f00000006c0)={&(0x7f0000000140), 0xc, &(0x7f0000000680)={&(0x7f0000000c00)=ANY=[@ANYBLOB="78001200060026bd70006f7256855c8f5405e164c0a06d1cebfddbdf250000516664cba3408179557096d7dbac0000a3237d426c1c7177ff4ba7558bc80aedd52b1126f4dcc26e8d97b003900119a31ea5a406789bf62b5d0db99ad1323bfb07519e1c657f32ca02000000a969cd959c7d511fceafdf538a3c353c3566740ac673b063c452981e97c0acd42f16f11d1d8266ed29681d3186685efd6c3471bd6f255d00d25e3daa2b11f52191d4d06d30d62139c957643eeff008bdad78908497997f03d501ec5a73cff4280ca7562d78ae07cc0da184003e0a8bfd0862b50eddcfad66e3d1769530e9e88352f6c6b34b61189250e52f4d23c5a375fdda88f9551a9199be42d6c46cfdb2390a47219a44d41c780b89d712d92feaeba1fe5e89b39cbcd97f05464cc4b092d433cea430ca589018404f33501029f5698ea27816df32f2910b018712e7218c71af2877", @ANYRES32=r7, @ANYBLOB="040000008000030058011680600001800c00090004000000010000000c000400010000000900000014000b008200000000000000070000000000000014000a000000120000000000b6040000000000000c00030007000000090000001000060001000000ff7f000004000000200001801000020000000000120700007f0000000c0004000700000007000000540001801000020000080000f3000000030100000c00090008000000010000000c00050005000000010000001000020009000000b1000000050000000c0009008d000000060000000c00070007000000050000008000018014000a00ffffff7f000000007f00000000000000100006000100000005000000ca0000001000060006000000020000000900000014000a000180000000000000000040cd0000000014000a0001f0ffff00000000f7000000000000000c000700900000000200000014000a00fcffffff000000001000000000000000"], 0x178}, 0x1, 0x0, 0x0, 0x4002}, 0x48040) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4, 0x70bd2c}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r10) r11 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r10) sendmsg$NL802154_CMD_NEW_INTERFACE(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000a40)=ANY=[@ANYBLOB="1400000098df58ba77d3907c3e73fe63fda51c1577f2a2c288aaea9f74b4de7ec7a1f23da382558532c2bae7a320e3ee0294cc568fb8ddd400326223af2d170f628728304f4b58a208cd6f73eb0e9629460511868bc85ad95c5f5b11708c46b0db67868d08d1c323d761de43e914b0dace8626121650dd5d96a12287902009b9865f27f866c4eaf156d0bb6e34d0afacfa668c3d0ba3aab49d718dbcf79ffe44f59c2012e0fa73aa6253b90feb614c9e243012afed445a9611295cbd47e615ce67", @ANYRES16=r11, @ANYBLOB="010000000000000000001c000000"], 0x14}}, 0x0) sendmsg$IPVS_CMD_DEL_DAEMON(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000640)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="554b0000000000000000080001800600010000"], 0x28}}, 0x0) r12 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r12, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000240)=@newtaction={0x14, 0x30, 0x53b, 0x70bd2a, 0x0, {0x9}}, 0x14}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$ipvs(0x0, r12) sendmsg$IPVS_CMD_GET_INFO(r13, &(0x7f0000000440)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000480)={&(0x7f00000003c0)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=r14, @ANYBLOB="010029bd7000fcdbdf250f000000080004000100008008000400530d0000"], 0x24}, 0x1, 0x0, 0x0, 0x1}, 0x4010) sendmsg$IPVS_CMD_SET_CONFIG(r8, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x400100}, 0xc, &(0x7f00000000c0)={&(0x7f0000000900)=ANY=[@ANYRESDEC=0x0, @ANYRES64=r13, @ANYBLOB="020035040000fbdbdf250c00000008000600080000000c000180060004004e2400000800060008000000"], 0x30}, 0x1, 0x0, 0x0, 0x40}, 0x40) executing program 1: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f00000002c0)=@pppol2tpin6={0x18, 0x1, {0x0, r1, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) ioctl$PPPIOCGL2TPSTATS(r0, 0x80487436, &(0x7f0000000b00)="9e17c2977a7873aee9") bpf$PROG_LOAD(0x5, &(0x7f0000001680)={0x1, 0xe, &(0x7f0000000740)=ANY=[@ANYBLOB="b7000000f8000000bfa300000000000007030000f0ffffff620af0fff8ffffff71a4f0ff000000002d0a0200000000001d400200000000004704000001ed00007b030000000000001d440000000000007a0a00fe00ffffffc3030000e10000009f040000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d66a77ac8daab82167606068067500c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923030000000000000014e72ba7a54f0c33d39000d06a59ff616236fd9aa5b4e377184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049ef6a989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7592566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270fa3d0ee281eaa11ad47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0c1e02b6e4114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840bd2951680f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42e54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65807ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91c11ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6cb5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e8262395174328f2482d14008de83070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cdb70f617af3ce64a92f95d89d125b1e64124 <> rd(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 14, 22, 20] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000180)=0x2, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x200, @private2, 0x5}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x9, &(0x7f0000001a00)=0x1, 0x4) sendto$inet6(r1, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) socket$inet(0x2, 0xa, 0xa22) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [15, 14, 22, 20] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000180)=0x2, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x200, @private2, 0x5}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x9, &(0x7f0000001a00)=0x1, 0x4) sendto$inet6(r1, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 14, 22, 20] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000180)=0x2, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x200, @private2, 0x5}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x9, &(0x7f0000001a00)=0x1, 0x4) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [14, 14, 22, 20] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000180)=0x2, 0x4) sendto$inet6(r1, 0x0, 0x0, 0x2200c851, &(0x7f0000b63fe4)={0xa, 0x2, 0x200, @private2, 0x5}, 0x1c) sendto$inet6(r1, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 14, 22, 20] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000180)=0x2, 0x4) sendto$inet6(r1, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 14, 22, 20] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r1, &(0x7f0000000000)={0xa, 0x8000002}, 0x1c) sendto$inet6(r1, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 14, 22, 20] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) sendto$inet6(r1, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 14, 22, 20] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 14, 22, 20] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 14, 22, 20] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_REG(r0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 14, 22, 20] detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 14, 22, 20] detailed listing: executing program 0: sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) r7 = socket$phonet_pipe(0x23, 0x5, 0x2) bind$phonet(r7, &(0x7f0000000000)={0x23, 0x20}, 0x10) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program did not crash minimized 30 calls -> 8 calls minimizing program #1 before concatenation testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 13, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) socket$phonet_pipe(0x23, 0x5, 0x2) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 12, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000080)={'ip6gre0\x00', @remote}) (async) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 11, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x240, 0x0) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 10, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000780)={0x48, r2, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_KEY={0x2c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_IDX={0x5, 0x2, 0x4}, @NL80211_KEY_DATA_WEP104={0x11, 0x1, "d80000b15f9c2e545ff0ff00e3"}, @NL80211_KEY_TYPE={0x8}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x820}, 0x0) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 9, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000540)={'wlan0\x00'}) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 8, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 7, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_route(0x10, 0x3, 0x0) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 7, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 6, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 5, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) (async) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) bind$phonet(r0, &(0x7f0000000000)={0x23, 0x20}, 0x10) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 4, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: socket$phonet_pipe(0x23, 0x5, 0x2) (async) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000000)=@delsa={0x34, 0x11, 0x1, 0x70bd25, 0x25dfdbff, {@in=@rand_addr=0x64010102, 0x4d3, 0x2, 0x6c}, [@mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x34}}, 0x0) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 3, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: socket$phonet_pipe(0x23, 0x5, 0x2) (async) socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 2, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: socket$phonet_pipe(0x23, 0x5, 0x2) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 22, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 0: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(r6, &(0x7f0000000080)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp minimized 14 calls -> 1 calls minimizing program #2 before concatenation testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 21, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 20, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 20, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) vmsplice(r7, &(0x7f00000003c0)=[{&(0x7f00000000c0)="17e4", 0x2}, {&(0x7f0000000200)="abc46908b3df918fe61946b2a7d85cf473884b91c53b94d51db7a5918ed07847c392ee17a23d6fea", 0x28}], 0x2, 0x0) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 19, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6(0xa, 0x2, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) sendmsg$inet6(r8, &(0x7f0000000000)={&(0x7f0000000180)={0xa, 0x4622, 0x1000000080000, @local}, 0x1c, 0x0, 0x0, &(0x7f0000000100)=[@hoplimit={{0x14, 0x29, 0x34, 0x4}}], 0x18}, 0x20048855) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 18, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6(0xa, 0x2, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWRULE={0x98, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x70, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8}, @NFTA_EXTHDR_LEN={0x8, 0x4, 0x1, 0x0, 0x22}, @NFTA_EXTHDR_TYPE={0x5, 0x2, 0x7}, @NFTA_EXTHDR_DREG={0x8, 0x1, 0x1, 0x0, 0xf}]}}}, {0x38, 0x1, 0x0, 0x1, @bitwise={{0xc}, @val={0x28, 0x2, 0x0, 0x1, [@NFTA_BITWISE_LEN={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_BITWISE_DREG={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_BITWISE_MASK={0x4}, @NFTA_BITWISE_SREG={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_BITWISE_OP={0x8, 0x6, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0x10c}}, 0x0) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 17, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 16, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$inet6(0xa, 0x2, 0x0) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 16, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) pipe(&(0x7f00000045c0)={0xffffffffffffffff, 0xffffffffffffffff}) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(r7, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 15, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 14, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 14, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 14, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32=r5, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 13, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r3, 0x8933, &(0x7f0000000100)={'wg1\x00'}) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r4, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 13, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r5, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 12, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r4, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 11, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000000)={'wlan1\x00'}) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r3, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 10, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r2, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 9, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SIOCGIFHWADDR(r1, 0x8927, &(0x7f0000000100)={'vlan0\x00'}) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r2, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 8, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 7, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000080)=ANY=[@ANYBLOB="240000001900dd8d000000000000000002800000000000060000000008000f00ffff"], 0x24}, 0x1, 0x0, 0x0, 0x80840}, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 7, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 20] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 0: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp minimized 22 calls -> 6 calls minimizing program #3 before concatenation testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 19] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 19] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 19] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(0xffffffffffffffff, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 19] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 18] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 17] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000003300)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=""/101, 0x65}, 0x8}], 0x1, 0x0, 0x0) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 16] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 15] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 14] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$inet6(0xa, 0x2, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 13] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 12] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x18, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 11] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000000)='devices.deny\x00', 0x2, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 10] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 9] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00', r1}, 0x10) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 8] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xc, &(0x7f0000000800)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000000e00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 7] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 6] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 5] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) socket$nl_route(0x10, 0x3, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 4] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 1, 6, 3] detailed listing: executing program 4: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) executing program 1: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) executing program 1: openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp minimized 20 calls -> 3 calls testing program (duration=9m1.5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-openat$tun-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-write$cgroup_devices-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync bisect: concatenation succeeded found reproducer with 18 syscalls minimizing guilty program testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-openat$tun-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-write$cgroup_devices-syz_init_net_socket$bt_hci-bind$bt_hci detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-openat$tun-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-write$cgroup_devices-syz_init_net_socket$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-openat$tun-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-write$cgroup_devices-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) write$cgroup_devices(0xffffffffffffffff, &(0x7f0000000140)=ANY=[@ANYBLOB="6340003a2a2072776d00870a4cc119f01c49da8f66bd4a641869eb8e479f003a53b60cbbd2a5a8d472735aa71c2237e1d5269ff3afae22c220f75b15421057bfd8d9449f112a2e0ec1cea5bf3604885578d85cdc2075b61c03362aeb2117bcc46a3c1d3507e486d6058f0d6108d628c2ae15e0e92f314631d750ca1edb585aa180942e94f840abe72f9bdb8a976ea1c06b42b9a7afb2"], 0xa) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(0xffffffffffffffff, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-openat$tun-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-openat$tun-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-openat$tun-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-openat$tun-sendmsg$WG_CMD_SET_DEVICE-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-openat$tun-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(0xffffffffffffffff, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-sendto$inet6-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000000200)="44f9b108b1cdc885c9c533d21f474bec8bfef1df1e2da71e578dc6b91d09f7ab15378571d8e27546090011006e75436914ab717528ee4b7a9beaf908d11137c11903064e83b4951f4d433a5404970c85d92d7083fd38844cbb0c6c5eb508ddc2dc7a590aa7941b1e9eeb5a688138dea09b776cbfa784cbf550bf3074fb0d775da4df5a3f48bbdf452eeb6b923da9d0e25b80f76a873664b5", 0x98, 0x4000000, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-sendmsg$ETHTOOL_MSG_COALESCE_SET-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_COALESCE_SET(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, 0x0, 0x0) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040), 0x0) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000004c0)=@newtaction={0x74, 0x30, 0x1, 0x0, 0x0, {}, [{0x60, 0x1, [@m_ct={0x5c, 0x1, 0x0, 0x0, {{0x7}, {0x34, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18}, @TCA_CT_ACTION={0x6, 0x3, 0x28}, @TCA_CT_NAT_PORT_MIN={0x6}, @TCA_CT_NAT_PORT_MAX={0x6}]}, {0x4}, {0xc}, {0xc}}}]}]}, 0x74}}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) (async) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in cmd_complete_rsp testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16, @ANYBLOB="010000000000000000000100000006000600234e000008000100", @ANYRES32, @ANYBLOB="423cc035eb030b8a04887a085ce3c1b43c97b3454370cf8720da8ab9a9a949415a7d92269ced7c82cdb99456c095044a5d54ae6f1cd662806435a096556021c35f8e096354db1a783a55113936bd34ba418c14c4d2aebc3dcd486c7038001da2e705e4799a51ac7a04e11d2d2caaec84e13a0267f92bd382aa81acadda57e7f4884481c2409a045f82fd392655908a3a7bab8fb946b55233a66b10af9281b602989be343743334e5bb2cd7fd1ebacc97aa5efd601acbdb1b7181fe23b615e721b4381f418e47b2"], 0x24}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, 0x0, 0x0) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program crashed: KASAN: slab-use-after-free Read in set_powered_sync testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, 0x0, 0x0) write(r2, 0x0, 0x0) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, 0x0, 0x0) write(r2, &(0x7f0000000340), 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write program did not crash simplifying guilty program options testing program (duration=1m51.159399476s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, 0x0, 0x0) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash testing program (duration=1m51.159399476s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-epoll_create-sendmsg$nl_route_sched-sendmsg$WG_CMD_SET_DEVICE-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY-socket$nl_netfilter-syz_init_net_socket$bt_hci-bind$bt_hci-write detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000040)="05000000010000", 0x7) epoll_create(0x800) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) sendmsg$WG_CMD_SET_DEVICE(0xffffffffffffffff, 0x0, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, 0x0, 0x0) write(r2, &(0x7f0000000340)="41000000010001", 0x7) program did not crash reproducing took 9h49m37.928362371s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1354 Read of size 8 at addr ffff888032da3098 by task kworker/u9:2/5888 CPU: 0 UID: 0 PID: 5888 Comm: kworker/u9:2 Not tainted 6.12.0-syzkaller-05480-gfcc79e1714e8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci0 hci_cmd_sync_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1354 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 6041: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295 kmalloc_noprof include/linux/slab.h:879 [inline] kzalloc_noprof include/linux/slab.h:1015 [inline] mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296 set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1395 hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 sock_write_iter+0x2d7/0x3f0 net/socket.c:1147 new_sync_write fs/read_write.c:586 [inline] vfs_write+0xaeb/0xd30 fs/read_write.c:679 ksys_write+0x18f/0x2b0 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6041: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1444 mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x106/0x430 net/bluetooth/mgmt.c:9520 hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508 sock_do_ioctl+0x158/0x460 net/socket.c:1209 sock_ioctl+0x626/0x8e0 net/socket.c:1328 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888032da3080 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 24 bytes inside of freed 96-byte region [ffff888032da3080, ffff888032da30e0) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32da3 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff88801ac41280 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 8, tgid 8 (kworker/0:0), ts 252960618333, free_ts 250634999696 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3474 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __kmalloc_cache_noprof+0x1d5/0x2c0 mm/slub.c:4290 kmalloc_noprof include/linux/slab.h:879 [inline] kzalloc_noprof include/linux/slab.h:1015 [inline] nsim_fib4_rt_create drivers/net/netdevsim/fib.c:280 [inline] nsim_fib4_rt_insert drivers/net/netdevsim/fib.c:426 [inline] nsim_fib4_event drivers/net/netdevsim/fib.c:464 [inline] nsim_fib_event drivers/net/netdevsim/fib.c:884 [inline] nsim_fib_event_work+0xe1a/0x4130 drivers/net/netdevsim/fib.c:1493 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 page last free pid 16 tgid 16 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0xdf9/0x1140 mm/page_alloc.c:2657 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:943 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffff888032da2f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888032da3000: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc >ffff888032da3080: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888032da3100: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc ffff888032da3180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1354 Read of size 8 at addr ffff888032da3098 by task kworker/u9:2/5888 CPU: 0 UID: 0 PID: 5888 Comm: kworker/u9:2 Not tainted 6.12.0-syzkaller-05480-gfcc79e1714e8 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Workqueue: hci0 hci_cmd_sync_work Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 set_powered_sync+0x3a/0xc0 net/bluetooth/mgmt.c:1354 hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 6041: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:257 [inline] __kmalloc_cache_noprof+0x19c/0x2c0 mm/slub.c:4295 kmalloc_noprof include/linux/slab.h:879 [inline] kzalloc_noprof include/linux/slab.h:1015 [inline] mgmt_pending_new+0x65/0x250 net/bluetooth/mgmt_util.c:269 mgmt_pending_add+0x36/0x120 net/bluetooth/mgmt_util.c:296 set_powered+0x3cd/0x5e0 net/bluetooth/mgmt.c:1395 hci_mgmt_cmd+0xc47/0x11d0 net/bluetooth/hci_sock.c:1712 hci_sock_sendmsg+0x7b8/0x11c0 net/bluetooth/hci_sock.c:1832 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 sock_write_iter+0x2d7/0x3f0 net/socket.c:1147 new_sync_write fs/read_write.c:586 [inline] vfs_write+0xaeb/0xd30 fs/read_write.c:679 ksys_write+0x18f/0x2b0 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 6041: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:2342 [inline] slab_free mm/slub.c:4579 [inline] kfree+0x1a0/0x440 mm/slub.c:4727 settings_rsp+0x2bc/0x390 net/bluetooth/mgmt.c:1444 mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x106/0x430 net/bluetooth/mgmt.c:9520 hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508 sock_do_ioctl+0x158/0x460 net/socket.c:1209 sock_ioctl+0x626/0x8e0 net/socket.c:1328 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff888032da3080 which belongs to the cache kmalloc-96 of size 96 The buggy address is located 24 bytes inside of freed 96-byte region [ffff888032da3080, ffff888032da30e0) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x32da3 flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000000 ffff88801ac41280 dead000000000122 0000000000000000 raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 0, migratetype Unmovable, gfp_mask 0x52cc0(GFP_KERNEL|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 8, tgid 8 (kworker/0:0), ts 252960618333, free_ts 250634999696 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0x3649/0x3790 mm/page_alloc.c:3474 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2265 alloc_slab_page+0x6a/0x140 mm/slub.c:2412 allocate_slab+0x5a/0x2f0 mm/slub.c:2578 new_slab mm/slub.c:2631 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3818 __slab_alloc+0x58/0xa0 mm/slub.c:3908 __slab_alloc_node mm/slub.c:3961 [inline] slab_alloc_node mm/slub.c:4122 [inline] __kmalloc_cache_noprof+0x1d5/0x2c0 mm/slub.c:4290 kmalloc_noprof include/linux/slab.h:879 [inline] kzalloc_noprof include/linux/slab.h:1015 [inline] nsim_fib4_rt_create drivers/net/netdevsim/fib.c:280 [inline] nsim_fib4_rt_insert drivers/net/netdevsim/fib.c:426 [inline] nsim_fib4_event drivers/net/netdevsim/fib.c:464 [inline] nsim_fib_event drivers/net/netdevsim/fib.c:884 [inline] nsim_fib_event_work+0xe1a/0x4130 drivers/net/netdevsim/fib.c:1493 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa63/0x1850 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 page last free pid 16 tgid 16 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0xdf9/0x1140 mm/page_alloc.c:2657 rcu_do_batch kernel/rcu/tree.c:2567 [inline] rcu_core+0xaaa/0x17a0 kernel/rcu/tree.c:2823 handle_softirqs+0x2c5/0x980 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:943 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Memory state around the buggy address: ffff888032da2f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff888032da3000: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc >ffff888032da3080: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc ^ ffff888032da3100: 00 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc ffff888032da3180: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc ==================================================================