Extracting prog: 12m21.029126049s Minimizing prog: 42m23.914889472s Simplifying prog options: 6m44.857129868s Extracting C: 2m38.532254112s Simplifying C: 0s 30 programs, 3 VMs, timeouts [15s 1m40s 6m0s] extracting reproducer from 30 programs single: executing 5 programs separately with timeout 15s testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-connect$rxrpc-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS-sendmsg$NFT_MSG_GETRULE-socket$nl_route-socket$nl_generic-syz_genetlink_get_family_id$nl80211-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_FRAME-socket$inet_tcp-setsockopt$IPT_SO_SET_REPLACE-ioctl$sock_inet_SIOCSARP-socket$inet_udp-openat$cgroup_ro-mmap-openat$cgroup_ro-setsockopt$inet_group_source_req-sendmsg$nl_route-socket$inet6_tcp-listen detailed listing: executing program 0: r0 = socket(0x2, 0x6, 0x0) connect$rxrpc(r0, &(0x7f0000000480)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, 0x24) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[], 0x7c}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000280)={0x7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xff}, 0x6b) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x75, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x1}, &(0x7f0000000080)=0x18) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000400070a0101000000000000000005000000"], 0x14}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000a00)=ANY=[@ANYBLOB="68010000100013070000030000000000ac1414bb000000000000000000000000ac1414aa00000000000000000000000000000000000000000000000000000000a8c95e370a9a424d0bae70216a4958b3d147782ae1bc117f6b02f60480eb4e", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f00000100000000000000000000000000000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480002006374722d63616d656c6c69612d6165736e69000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000e00fe8800000000000000000000000000011c0004000000000000000000fc00"/288], 0x168}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r8, @ANYBLOB="3c00330080000000080211000001080211000000505050505050000000000002aba519ed06dd895d00000100040600000000"], 0x58}}, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000480)=@mangle={'mangle\x00', 0x44, 0x6, 0x418, 0x2b0, 0x210, 0x2b0, 0x2b0, 0x98, 0x380, 0x380, 0x380, 0x380, 0x380, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x0, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @ECN={0x28}}, {{@ip={@loopback, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@multicast}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x478) ioctl$sock_inet_SIOCSARP(r9, 0x8955, &(0x7f00000000c0)={{0x2, 0x4e22, @empty}, {0x1, @multicast}, 0x8, {0x2, 0x4e21, @empty}, 'syzkaller0\x00'}) r10 = socket$inet_udp(0x2, 0x2, 0x0) r11 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r11, 0x0) openat$cgroup_ro(r11, 0x0, 0x26e1, 0x0) setsockopt$inet_group_source_req(r10, 0x0, 0x2e, &(0x7f0000000480)={0x3, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @loopback}}}, 0x108) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="3400000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0000ebff000a00020411ba67aaaabb0000009c000000000000000000"], 0x34}}, 0x0) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r12, 0x0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000005040)={0x0, 0x60000000, &(0x7f0000005000)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x3, 0x0, 0x0, {0x1}}], {0x14}}, 0x3c}}, 0x0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-sendmsg$nl_route-ioctl$SIOCPNGETOBJECT-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$ieee802154-ioctl$sock_SIOCGIFINDEX_802154-syz_init_net_socket$nl_generic-ioctl$sock_SIOCGIFINDEX_802154-syz_genetlink_get_family_id$nl802154-sendmsg$NL802154_CMD_DEL_SEC_LEVEL-sendmsg$NL802154_CMD_NEW_INTERFACE-syz_init_net_socket$nl_generic-sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL-sendmmsg$alg detailed listing: executing program 0: r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010", @ANYRES8=0x0, @ANYRESOCT=0x0], 0x48}}, 0x0) ioctl$SIOCPNGETOBJECT(r0, 0x89e0, &(0x7f0000000000)=0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r2) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)={0x30, r7, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_LEVEL={0x14, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x30}}, 0x0) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000001740)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x38, r7, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xffffffffffff0083}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0302}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0102}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0x20000010) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x2c, r3, 0x60b, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5}]}, 0x2c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000001880)=[{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000100)="937a07d330673701d08287fd074fbb692a60d5a4e45edaa2560f28ae2f26fa55dadbfd3420182722a617adf5b2ad34ca1c49d2b43aaa4fdcd727c46b3122ae55b2bb", 0x42}, {&(0x7f00000001c0)="bd4a1cd310c827f04306856cc2ceadec8e8af05d5eb0667a88", 0x19}, {&(0x7f0000000200)="cc3fc2e8423f55f7c6f1705c2f0c4726fa3766ba31b1727f63cd0ccabf1d56bdf48db350a6a69d4bbb0c5ba669d14055ea29213355f5bebf863cd8eb85c880721d76f4de983f95e4fb3d3a0178287b9d4a163e0f68a9f2e4fbdcec016209f16debd4bfeadd9d87b5b517d00b8a565ee7240893e107159d2c7b43b8eb7cd091079d3e94901266684fc29e045ded8e81f538a3943bee97087b27c4bef4fdb7d87f2dbd607c3a7f4598e1831a79fcf3018e51bb62327fe90e9ac823e9d09549b81be01b2abef08e30fe303c4a65286d587eea0a193f0f905c01f305c21a716e6218ed459bf9413d2ea20ebc7b506f831482fa88d36dd5b4", 0xf6}, {&(0x7f0000000300)="a140a67aefc4adb63477db4a5c1e3d474046e5e0d40cc5087844e34a4e02b5889e1349588d4953621512f4805b2bcd810e689bdcf20c4ee2b04836e56a552d049e8315d0d3b3bbc1f0fca8b7de2f39bd22345f4f7c0e13db7e470a069fc49e786de34212f9bd0e25ba29cf1bc8f7ea168eb8ada5dabf4e20450f850f8d0485a4fc9208cadd3dcde9aa0933696cd144966bfad91732d1c75a4ae134ad66ce068cd7fe6980cc9804342fda9c88fe546831e40457e9cd85ed9164c57ac190a74510e9a1ece86d", 0xc5}, {&(0x7f0000000400)="50aa80e8e1d6dd35b35f3b294edeb18ba0ae4abb7cfdf68864d281ba146b609406cf41bf0f90cf4451807af55b7d4906502b2dead0c5692d9edfdf22b2168f89ceb93aa5d785c289c2a89061e31a25825b18d5b5edb32d65f66f6ce035aee7c33c995c0b6df419627d50c17e22a993251750bd435c335391ed408b4a31a5c7d823ca0681023e66f62b8fc71b564076896edd8a33a83b8de9239dbd7e2b73da539d6689495c968b8fe9c9134e5a1fb8468c755b808e475bb7235877cbfc97b4dcd495b62cadd8bf91ffa2fcd90a3228f70ade5f28272b57816f5780a297a4ef3e4f297973424bc943", 0xe8}, {&(0x7f0000000500)="91fc6ae21b733f42467be34f451de56760da3a70c2504ea31849465c5ce1f52c4246548e017b32b196850e5220ed9fdc0cba567cef2030c1b124ccc0948cc2bf103c09a4032942bdd8c88ab89302457d32cedbab0767cc65ac2f68a7ed4717dbd32340684aec003924b3714de572933ed919fffa41ad", 0x76}, {&(0x7f0000000580)="e6ece36aaf5b98d938b399f2dd7ca8ec686fe81e2498c22fe13b97d8c11091fa72ff410f0d3daf0e5fb49f50ab919fbac104030836d109b6e003f7aa004a28e751e583cd30087d918af07b539781b1d74b121f29a33321a098ad82ce5980f5b6ac5bc969", 0x64}, {&(0x7f0000000600)="6ad74a7964240b7a2081dbdd5e151572d08dc5f319f3b2963d5760e97ab5cea7fcb0ab806d85592f1937e1c3372608eb6f4f0b8f9d44425b0b3d65fadefdcb8b4120285bb5d2d65e311dceea58efe9bf097f133d390baf9b1d67caa5bd1ac7b60edd82b0c6d155dd28802a589792f6438ca8403dd4ddc5cbbc2c30bc9c98592e4ab7bb6c10cce18ef5537479908f34ff483d1c29b8f56de81bfa91a70145aebc8cb7cb8a9af0f7d58561dc74483d3116ac459948a0c21e3bb87d37b3399f9f8e1dad2a41e703eefb61c0db2ddfefec5f6125ee3e6e09e636773f838dc6b0c633edd0058652c2d6ff159b7f4b793d9ce8b34072b4b7ecf48d1ecc65749d7965b1444a2bd3991e17c452e900edb6aaaa0a670f9f239d2e2b8d7d5ee7d108eedc30c911034f62f77ee63f79e54a0c17724dd26f8bff1dd40ea38cb0c271ad003a57458f07521b139fc3e953981c1d37759687d9d405304b88020b0add60eafaecc3ca3ca80b48176ad8c349bf4b15159b694db3ccc0ffef4ac820734a6d1f7008873ff68b5bb014200b46a07c76da8100ba0885277ebc5e70fad73bb0d15b85bb76469ccc1ea5eaa6036e294cb194a021ba77e233bbabcbb1a9fa522171010afc4152b6ea9c71e27ff6044235cbb57e1cd15cf85931a9b4699b2ac968c875f7cabf83a28d392a6e420beae98d690059ee9f4deccb47336dcb3be6017eeafbd4d5762166d965913395e1f58db48499353c94927fe10394aaaf1236522b10faf359b96a1bafefce2ecee64e8162ef07daf89310cc08ad50ac1f663824fcb37a159403d8c3ebde969f86e6ef9ecfeb15e021daf0f312d6ac9b095670451d023bdd6ce06ed25338293bc6a983e7e73b76ff6dbc519030c2fffbaea83023323900e4bc981af9333a45591f640002368194285c78d64b8528a0f36f2c49ab9a5a73a50d42da31e1dd5093bda117a62608c14545c5f65ada05295585c46a38cf0acc5b562f98f993fa8c00a9d92924abb903f74e89ea93f3be7a37ad3c2335ffd2640ead6789186469fe8a435eef9f42f958a9f712fda0cc452f98575d067b908faeae157b57187766372b43509dc276c7272deb82bbbbaf7927af6f4d5e2d40ee2338c35942bcc0c90783a510d3117f0affe753bbde585a1ef9b5644626d10f28a0ce0ee56416535b7027ac3501b77076f017fe47444b77a2ca8b2ca4b354136d657a9165241bc6abf4c3605c407032d4ace6e7d4f00ef5f06755c843076bb8f02a533036ce54df92b97de1ed21156e3f5072328e07a5f8510e54fcab14c374e381ce7fa208de9da13b40b7597fe1c8b892e93c941bae361128d995c9acf4071003ad090f019e65221d942d490e2a83e52067c5a4e264b993ead7c9ca4c7492ca2a0c7f8d7f75efa4d39b43f3dda0abd95465c8b6ecb09621c76e841b9a9f709e7f131f3dafc9be7130d59bc587532c2530cf698d5e8bd32332e9d53da3bf3378d2246f3e38a657205ba7a6739094f8f66d400a20529bee6a7d701ecfda3bdaf402c9a7d65e6c92848c3cc04e2fb33b10828f6e5bd2305d87c83b62923780a16b4bc68d20ae1db009d5606c223267d9aca2a10f23e4061f5b55a4d696ae6b812cc7069f51ef9ffec31e353b17c46a5ac0cb22e64103d602303fd8e419121ec8e955e5760a52f2838ff0943beb4ae4af89c3a3a96f961ab4493d4596279e9ce30395fecaab666ee7604cee8218b093307d10716a5a9f3260641dcb3d5e6c416384c9dcffdf9e169fffec093bc9cc83f526f2868556d8059e909842c78c9f77fb1f7e61a7a3e8cd8de7b585109cc2c1a832e3c4d9159789cee8c6b69a06fe575df88187fe0186f2866023dbc2ff614e78377020ad59d12c64d25808e4caa88f665d041aa79338b704ecf4c0cf0e6e1d34329df9dca4762ab1c11de49ac7c9c043e9bf980bc6744a9695b30b8cff55ae48c898364949db5d97d7b945adcb4f7356fce466fb52e0a5cf26defbb5a9a82e7680131bc27eaa4abef879837c61e9d493fb8ed9074b5757327258eb0ee6d18294b900532dba56c9954e1a1d39ee405d5115045509ce8b5cc6a90d9da1d798d07090ea7cd3bab95b5f4eb615318a8368845ad140a738af7fc41ae2ffb85e73db80b4f7fc6b07849667ae53e8b54f8d406777f572298d3476a6dad04f9c476e672f8d08bbf5c3511fdeb5c04a4ebd90c9d2abdfecd3dbb4fdacec7df4ffa831813c7d60462ce1663f857037eca50f73f418a244efad2ccfc0d1376d9bfcc16a5368bac2cdd19343ced9cc5b79dc6aaddfbbb346bc378b6e359be197b8aa211af6e673b928256951486dc87e88492fbe89261aec077482ef337ef27f5fb83e5f4769c33dee864dedcf0f4d97fcca90e583227849baf120ea3dce4a343ad1ac1524e4158afc35da7bb5defbaebb7e456772eedf808e74dcd806d26bae873f6c561909f3b71478eed4aab71c4ee3344f4219fc38978acec25ab81f7d84f12cf6f4de294f7cb881ab0fb1af03f3c718cb7d3cc5d6996d07bdfa082558438ed400333cca2b1b9ee2bfa7e9c0e41f67773ae4526bc48cd3675c3238802ba44263fe51c047e21c4a46730d1561c9b7ba526ce99405065a5f26caf7063e727a73b67292691a0b29c94686326d50697a35289b386672e71b6970ba61d1b68e516c159e2b56119f781fd2ce143c1d629831bfa87978ef67fbb72aab5bd7a890a34188ab7d37c1963a9a6146ae5305d6fb632961cdc6a56edee481be04f1bc040e670a39ad1ab6c071255f684a9cffeb2fce019b6c580da3ad95c2a924114b92073bbad4f3af3b8616c9d74f396fde8cb05c538ee0ac16ee5ab2665994a4d19517038ddc7db89a10545908790d18b09900005215cb87d9b7298403d902412407ef01ade94d12f5c52ac7285d878f5740767d7c145d8452ce80246d6e1c6e92cd81c03e100b55e255415f8d21b891873640d6cde767d51a1823c483f5f2d12f44c97019c6476a49fc03c567ab605fb4925a2fc243b3fae0107e53567afdd84821b9167c970268f37ba3112dc2d93f8776d89f29a667fe02f18b4cfa86ccc0299a5797daf02ab6f64fae279991ebe148e07c4950fb9f96da0586e8c630067f8b7372f72494b53680673caf77c58dddbe177eead1b81969cefc7da8b1cd9de67e96a4daf01b9152ccc6ccd3ff14f291dac91a506a795d1ac9288e8a4cc682b8625eeb699ab3d6496f53dde1005329a4f26992e2937260a031e4cb4579f3b6db63e4d3d2ad6739af9d64b45e5e7f8fe13dd3c36d46145c3cf176539ea301645afb05c8b5e9d22e677809e2f9134218d38ae0b1b5108129088d79df1022e7d9d70f0c276dccc2c5902497d0a46f92a7a2d5220be23b96030c40e26a0a8361b386b8f7202f2ff6807d25fbaf6012fe63bdbc6789305160e96d2c804f0a6d5ffb596b2bb93b9e7a66afe01f3cd2bf079b2e8ae055aa03c38530bd50afd4f191972a53c25332bce364baa204cecc6ff89e57e906a99b935dfa281d9cd1ad69d896436b0f849488fd0e2b08461c4f77c50aba4916c86482699380bac77ef67f5bec9a227e0ba3fbe8b11fb104c2f0d0fa1a888f5ec115cb68797bb84d375ea00545e5a900d09d1b418c1660a2092aadc38fb5c793b3d46d19bf47534bf977088391da73440e7d423ac497c307402aeedd7042e6ac621b44c97e4456d3bc4852a7e7ea69a1e43e928d39c318e1d2e8892f008970100d798398499f484e1bd47e72d4ccaac423b9cc89a8f9d26aaa93670af10ac72e749d438d7bd24ca5201cce2e6df68a3e28c8415cb5ccc36edfdc2b25f18390ab018722054f81c703e3bfc8b1d9ca7253516e704b2ece2dc016167f52f14cbdaef116766fdd45ca205725476cd1e679a31d253296c5eea4c0adfe6f43181dba44afad3af0fb111c949217d644863355a0ada255ad2089d068ef18886a3c347b9fc85b9e9a7f8b2437ec8920d77aa6fc0255e6aa809efae3f4fdaf242de203fd28eba25535aa5b13dd4bbbf84ba90d4c6c6da3f0ff6c8c0d1f1ef88cfb156ba48e9479f79f548dbf51928cf17195d3a1d116fccf1b13ee9833b4bc9c7c4cd954fb8478b1f32d6ba7e4274cdb400b636e44e2bae1bd47e703fcad79530d53119f6d326ace28c59a6f26094d94cb64ec108fe35e7071f5f4db2e9e335ee702f7d73bf438496a644345a27e02c404fd018fb719ce49e896741898a853517054aeed7e368d0573586eb198ca997733d8a943dedd210cf6ec024079816a23ab298e4e02d46f861b03f26ef3cb1a5e6b9d8348747f4d28a19fdc305967521f71721114ab4ab066daddddda7f3de1a91f9590f7ced2843f03542290f3045b81bf2f64aca59de943a5a8bc96b4a26788ba714e1381bc749f6460b3a12f2dc3800206f32414d0f00d848027538c169d54789637eaaf318f62a9bf0591824163870bf9243162e7e1654896cb3cd09254c1e161f5da2499a0b93e098e0db10fd50f6bf5d3f6211950d4a1049a32fc74b6fce4e7c655adeb74a492c088a2af51f72a050e4a9872ab2827eeb64bc79777f1db45d26c99bb7a87c6832e7d25188a0831c48e6e119d319c669287dec3336c26c5263cfe7310370216ae6c2ad95b2b32a3683ea0d7b87b20af88c838a76196509990a2b3cd77cb15cb3ce7c7604ed0f64050ee2d2f4afba253782367df13182f04f83ce4656519bbfc94a80b9df095bd339a6b523ee9e448f31c481f42e7184cc753a5a907cacbd07f08934c7d43b312aba1d82b93c22ff7659b757d473446030707365b93d1b7269d2d0d518f43a49e0890ad11d6b20ad02ae135e33d7e0b623a01b1f6268748916103427ac03a80b682a4e55e1ec6c7eed563991d6c596c0720b979413f63c40950412d12ba50f500b112508c55ea27e314f81f80da353c4269c0d8af1cae6f7a433bdd4e7e7c54136d281f26681d332b7af4eed6614d6566483d28fcb2f4571259ae7a8adb70adc0341937db6ba57a052adc48dc50e3a9bffd08554f2fbb16eb92a47ca4674694f4379c8879efc1af148030802d69df5094fa3d517ee44918448ae9ed3bff88676a9f58a729629bf21f2f54035aa3688a0df00c43af301c0af13ee01e8998c3523cf8f1e2f4acdb3952ec83fb0240485e127d4824219f131058990577a6d6ae87657579194a06dd821d007b0ae8d0cd244ebe9d21a5dfa93649d37f04c5d642d98d216a655e9bc4708c370abfd82f63a20871f3f3f8e0da3a675336163b4c9a1ced0a26ac9d561053d28dd168819fd0ee497947493a3b867a898cd3fdb1021c98c34d63e509120390d4c2da071a1e11d115f5ce1ef94b01bded6a8482fc88702275d13e101f1dcb452cb45e49ac874f26aaa51ce08d89561a1f97eb65eb8ca1dad4c40c53eec1dae33eda48ef443bde37703a0a0822356a497697aeada646f4e8825988ab621b16e57fd712c7b06f6caf2d90dc571b3a9a9d09cd9b7eddb6ce9a2d762fac1b68ac3dba790719c6ea2f14ebcd9aa5af6b77f0048fd44a5b51103e9e626c75546b9bb563d0bc6c57b9efde8b5eb25e7eb020987eb2a986a8d9668a57e82af0608ec4f12a661c9e46acee8ea1e0c7136d286695f095ca573d1ce2754da94a1f86bb0fd2a002c9b45e70939e24f54082406f0d36f1ff9b22f8c4436ef6da275820ec4656a46bc1b73b2f0d7fd3c4ff590c905b95f1d80554c7549ec753b9da2d3cbf13f0935003a1ef55f578432e4b804f82e2d5956de17103fd7d50d7bcf5a83577b03a2e18b76b4020c8e443959c", 0x1000}], 0x8, 0x0, 0x0, 0x240108c4}, {0x0, 0x0, &(0x7f0000001740), 0x0, &(0x7f0000001780)=[@iv={0xe0, 0x117, 0x2, 0xcb, "676ba5796f8a0df7f9139d0e8b891df12b376c0a83f2c5e9922c94fccc38c923902a246f868d7d099aa03d2a5ef4d100e7ccfc98de832bf6a73946add30d17fa7a43c9673eee8972e38269dbe8d660d6b56266d66310d3ebc6ca1e0630e3bcf139c60116686d5cb88b32a77aa6ce732d06180180d2b57f92a5e873b7537d72fd56ff49ed820e8016202c6fcfa1a3299b9fdd9e76fe24f246c8d2ff27564119dbd437b34b0104719a3453a489ba40b6b9bd72184e3ae66044ef5e56907749ffbb92231fe2b648a82324fec2"}], 0xe0, 0x41}], 0x2, 0x0) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211-bind$alg-socket-socket$packet-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket(0x200000100000011, 0x803, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'xfrm0\x00'}) program did not crash testing program (duration=15s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_tcp-openat$cgroup_ro-write$binfmt_script-ioctl$FS_IOC_RESVSP-setsockopt$sock_int-socket$key-sendmsg$key-connect$inet-sendto$inet-recvmsg-ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0), 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x80000003}) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000340)=0x400000, 0x4) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000027c0)={0x2, 0x9, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x8}, @sadb_sa={0x2}]}, 0x28}, 0x1, 0x7}, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000480)="fb", 0x1, 0xc000, 0x0, 0x0) recvmsg(r0, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000000040)={0x1, 'pim6reg1\x00', {}, 0x7}) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 15s testing program (duration=22s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [11, 11, 11, 11, 11, 11, 13, 15, 30, 14, 18, 6, 13, 28, 5, 30, 5, 30, 4, 20, 4, 14, 23, 10, 4, 18, 30, 15, 2, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0), 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x80000003}) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000340)=0x400000, 0x4) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000027c0)={0x2, 0x9, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x8}, @sadb_sa={0x2}]}, 0x28}, 0x1, 0x7}, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000480)="fb", 0x1, 0xc000, 0x0, 0x0) recvmsg(r0, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000000040)={0x1, 'pim6reg1\x00', {}, 0x7}) executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0), 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x80000003}) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000340)=0x400000, 0x4) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000027c0)={0x2, 0x9, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x8}, @sadb_sa={0x2}]}, 0x28}, 0x1, 0x7}, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000480)="fb", 0x1, 0xc000, 0x0, 0x0) recvmsg(r0, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000000040)={0x1, 'pim6reg1\x00', {}, 0x7}) executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0), 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x80000003}) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000340)=0x400000, 0x4) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000027c0)={0x2, 0x9, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x8}, @sadb_sa={0x2}]}, 0x28}, 0x1, 0x7}, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000480)="fb", 0x1, 0xc000, 0x0, 0x0) recvmsg(r0, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000000040)={0x1, 'pim6reg1\x00', {}, 0x7}) executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0), 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x80000003}) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000340)=0x400000, 0x4) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000027c0)={0x2, 0x9, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x8}, @sadb_sa={0x2}]}, 0x28}, 0x1, 0x7}, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000480)="fb", 0x1, 0xc000, 0x0, 0x0) recvmsg(r0, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000000040)={0x1, 'pim6reg1\x00', {}, 0x7}) executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0), 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x80000003}) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000340)=0x400000, 0x4) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000027c0)={0x2, 0x9, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x8}, @sadb_sa={0x2}]}, 0x28}, 0x1, 0x7}, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000480)="fb", 0x1, 0xc000, 0x0, 0x0) recvmsg(r0, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000000040)={0x1, 'pim6reg1\x00', {}, 0x7}) executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f00000000c0), 0xfea7) ioctl$FS_IOC_RESVSP(r1, 0x40305829, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x80000003}) setsockopt$sock_int(r0, 0x1, 0x2e, &(0x7f0000000340)=0x400000, 0x4) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f00000027c0)={0x2, 0x9, 0x0, 0x2, 0x5, 0x0, 0x0, 0x0, [@sadb_key={0x1, 0x8}, @sadb_sa={0x2}]}, 0x28}, 0x1, 0x7}, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) sendto$inet(r0, &(0x7f0000000480)="fb", 0x1, 0xc000, 0x0, 0x0) recvmsg(r0, 0x0, 0x0) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000000040)={0x1, 'pim6reg1\x00', {}, 0x7}) executing program 1: bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000200)}, 0x38) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000100)="554fd397d1cba737d9832f3b25e6a524b5960428343335c179c752cdca96671092a361f35cf25d582b1ba8c6812dd367a95914b4a0f8f41f9a8eeb2530a9e91dc6745ad34f4e18a490f28bf67c20b241cd15cad034e9ad08b9d1364ff19622bb82b499428cd4892b039d54e9480ff61ead45e5ffda5b71519a709a8644b6ae78d92206854f"}, {&(0x7f0000000340)="8f672e6753e9f33b3c5b6fa3e92d984bee7d3ab020921c638a71fbbfb7278e98409c194d284213c2d98995722afe3adbfa17f30f58339d208090c3458c0fbf145978ad7abe4ffa1ac5ffaf92e7f7aa97c102999f338ef987c62ee0bf6530fcb604"}], 0x0, 0x0, 0xffffffc0, 0x2663}, 0x20000094) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="110000001400a10c000000d5b400000002000000", @ANYRES32=0x0], 0x18}, 0x1, 0x0, 0x0, 0x81}, 0x400c800) socket$pppoe(0x18, 0x1, 0x0) socket$inet(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x80005b, 0x10089, 0x2053, 0xffffffffffffffff, 0x3ee, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x1}, 0x48) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0x33, &(0x7f0000000dc0)=ANY=[@ANYBLOB="b7000000a5517f5fbfa30000000000000703000028feffff720af0fff8ffffff71a4f0ff00000000b7060000000000012e400300000000006506020001cd00007118540000000000c3640000000000006b0a00fe00000000850000002e000000b7000000000000009500000000000000023bc065b7a379d179fc9e94af69912435f1b6a693172e6191a12bebf9f9804ea033388cd15b65877ad4b200000000000000000beca090f32050e436fe275daf51efd601b6bf01c8e8b1abe4fef3bef7074815ae98743d1ace4c46631256dd19aed0d600c0b6199fe3ff3128e599b0eaebbdbd7359a48f5b0afc3996792043a6787bac46aa7aa400000000000069669622208266f896ba2c9e73c2efeec2dc565fbafb2cb63f5fef9ab79ff8abaa8a08f54a062107e9bb3e980fff675c8d3e91df6648a7a6aebcb63e0867b75690152af27711f0cbb9c06018d21bf3f87b8eb65323b4267a526d53442db8e48dbc5ce47d67d07441a7975d5e41b14fd0154a8246249952a8b61633ce068220defe09d3b1136af6d03e9cf996c13d1bfcdc54567a9ca80dec2e943fe4ae7c617cc071f7add70cfbd48f8f6b50fe6a8297d88efa73e7e601040000b4a685969f28902bdecf66ef39755de79ed2c711477febc96231a53984d00877301d0ec62427a8e38618fdd1ce9aaed569ebc5f2e58d6028e66139a737cc7146a131d47dcebb32ed67021d76e983223c998aec22242ae54e87f438d26982876b58f9134366952f7399a733f07138a736924f3709000000e97f0c117ec439c6b7b965752bbc06eced08d97a32ae4b1ad4d11c5b6f68ee841975233e4cea13f3ef04b2cab9cc256d4539dbafd888c7097c1169e0bebcc81ca3da40bf34b6c9c1da2d6ed8acaf2a8091820ff4cf6be74ddca8bf2eed0e11b2139e8c3ec95436af5269d5792decda7d8b5dcf8640b504ba23c6d0a7f67cdfd27328100ebf9319a56f0f9cee17deecf747f3493f1dc39551f4c9a40b3e93fa80b8234ccbf39a9ef09bd97321f0dc20956f44ba2c5ec2e7569b05cf4690ddc189f174046a8b214acf23f42fb51ed4819e6b4cb5a8bf2b559d0c198fe0315483b8beb9801d06c58b22dd713fe3b7ef18e21081aacfd091b754125a488cea18255f79bebcb3051f622f8a1d9af1908e88a58774a24f35a4ccdbedea6212286c23dd89c2b4b90647f17231472af8dda7f3ab20f093aad3ce875f7458039ee6d0a50deb7bc8eb393f056a5e7725531c5485278e0362338e2e2710fe00465e0d182a322091022cf5b814eeb9b3cab21196581e4d92d0b6fe5525285eea359274f1f21d69233bbe94941f10ba292100000000000000000000000000000000c18e93a0c5231779f2ee201e9fe7e63e84b57b5f05ecd278919bad330ffcb594b8255b3085b352ca9533d6c31c1a30158c30352f8a126a65cb6582e58aa641007418611df53a601c3a8fb8d2286e86abf98136f345446730f68f5d6d1817a9e1b09e5650d2599fbe719a45337d29eb3fef5f7f565457660dec6fe903a1c2ea4f40a8ea1c179892afa219fc69a44163f0d731de418e9fd82a8c4661caea674b19242d1840d047882f640ea248457288c5ffb63e857da03ff5c0475c3cfff41c4806f1dc750eb1c45ec3a2a0b064834010604d6f88a29e8e9bda2bc9c18d1b53a08f25d62ccaa46bc0235c830a7b3fe64bc6031b431bcad6b698a1ba6027870ea9e55fafbbf140c5f82a33ee4ac793b989c12a5827a7957f4d8136cf918b7cbf5bc5fc64c8001992536584586edded6f65bdd371ac84fd5cc60ab79b84e9e85a1c54d5666a5d133e95eff121621dff14b9de7a188b8c5387f9da63c2cce405bc44079e34e2db2b275bfbb54841d647338cad74be91144b780cf381a6860f641446ef73bd11d45f5e4df8f3c6440d8425fd7382225cf8c2cada01bf3cd5cbc6a403173e0c89a491c75efc3c21b7825a521c6011945eef94abc3000000000000000000000000000000d71b794e9b4c145caf050429937eef4364d9e1cbe9150bccd9b2e73757f1f5e8ac50736cd3cbc029ede2869642841371bb4b9c1aaa8826889a909e6716b60e4b568b6761f8ccc7d35b0e66357746b10fc481b47e67f1e14408c1ef3e018a5e647e3f607654f3bf82bcfb42be038a272d82f8362944f608b3810000000019fda0b1b607f1ab34194ed954973f7a5accc0938d3364ab07574d0b32fc30f3ab73d012b63ee905e98ab6989ec2c840cd216eb18fedfb3b204e94e170bae930660368d3799c9b1bf7556ac57164966791626f06ad2e332341965f72141ec140b80efd7720ccdaa890b79bc4523386bd66553121543c9a35b7adcf2f6b257fefef1d6e1da2ee94d3f822bf45aad21e5b5a3788ab584090664065af39b0f43968dcd7c5f8e5a8dc6298691423fbf7e8e012260bc62f9422434a547ef7ca37953d435098d9b71edd1a03e46d0ade465d0c0db0a51f9e29cac05e5a04f94e"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, 0x2d, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000000)={0xfffffffd}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x90) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001280)={0x18, 0x3, &(0x7f0000000940)=ANY=[@ANYBLOB="1800000008000000000000000000000095"], &(0x7f0000000240)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000780)='contention_end\x00', r0}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000c40)="c10e020022003505d25a806f8c6394f90435fc60040011000a740100053582c137153e37024801", 0x27}], 0x1}, 0x4000) r1 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x92c01eb, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f02003e000b05d25a806c8c6f94f90224fc60100005000a000200053582c137153e37000c0980fc0b10000300", 0x33fe0}], 0x1}, 0x0) executing program 1: r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x15, 0x10, 0x2}, 0x48) r1 = socket$inet_tcp(0x2, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r3, &(0x7f0000000000)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x13, r3, 0x0) getsockopt$bt_BT_SECURITY(r2, 0x10e, 0x8, 0x0, 0x20000000) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r1, 0x6, 0x14, &(0x7f0000000040), 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x2, 0x4, 0x6, 0x5, 0x1000}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000260018110000", @ANYRES32=r4], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$bt_hci_HCI_FILTER(r5, 0x0, 0x2, &(0x7f0000000280)={0x8f6, [0x1, 0x8d], 0x3}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x17, 0xf, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000018b7020000c3b8027d85b560000000008500000051000000bf0900000000000055090100f7000000950000000000480dbf91000000000000b702000000000000040000000e003cd8c7ff0000009ac19d88"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) executing program 1: r0 = socket$kcm(0x10, 0x2, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000300)={'vxcan1\x00', 0x0}) r6 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$sock_inet6_SIOCDIFADDR(r6, 0x8936, &(0x7f00000009c0)={@remote, 0x0, r5}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000100)={'ip6gre0\x00', &(0x7f0000000300)={'syztnl0\x00', r5, 0x4, 0x81, 0x7, 0x1000, 0x0, @private0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x1, 0x20, 0x1f, 0xbd6b}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(r7, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000600)={0x34, r8, 0x211, 0x0, 0x0, {0x35}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x218}}, 0x0) getsockname$packet(r2, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r10 = socket$kcm(0x10, 0x400000002, 0x0) write$cgroup_subtree(r10, &(0x7f0000000100)=ANY=[@ANYBLOB="0007000042009103"], 0xfe33) recvmsg(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000440)=""/96, 0x60}, {&(0x7f0000001a80)=""/4104, 0x1008}], 0x2}, 0x0) sendmsg$nl_route(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="34000000100081eee80000040020000010000000", @ANYRES32=r9, @ANYBLOB="ddfffffdff000000140012000c000100627269646765"], 0x34}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)=ANY=[@ANYBLOB="3c0000001800010000000000000000000a00000000000000000000000c00090008000000", @ANYRES32=r9, @ANYBLOB="14000500fe800099"], 0x3c}}, 0x0) sendmsg$kcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000380)="0401020028000b05d25a806f8c6394f90524fce02200030500000000000000c137153e370248018000f01700d1bde6b35f6ebfc29c55f94b7c10c4101181fe26e60da909bc0f7166b57c4d63804194449cfd3c4dd0269da5125f7ab183280bfedf10972ff762a003727b4e7c3a0b937e9ffb046509db6ddd1363", 0x7a}], 0x1}, 0x800) socket$nl_netfilter(0x10, 0x3, 0xc) socket$igmp(0x2, 0x3, 0x2) connect$802154_dgram(0xffffffffffffffff, &(0x7f0000000400)={0x24, @short={0x2, 0xfffc, 0xaaa1}}, 0x14) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r11, &(0x7f0000000340)={0x0, 0x1c00, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, 0x7, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) r12 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) pwritev(r12, &(0x7f00000007c0)=[{&(0x7f00000004c0)="38b294b8051be06c24d7f5e39d944a13910672adb43e6e4ebf4a0f671cb05114f0e9f0fe38b7063e3cdd6fdcdc58cdd56e7a23ed47b986dc57602d1409dffa96a34f25aa055fed17e1281a400f7801000000000000002df260fb8c66eb60983fa3ccb36acf7b86242f0fc13bcf5c014ef681d62beb8904100e07049560c4d591995e1ae6d4a6969be860091d44c33a5e1f05dbcfd9c0665e6d809bb3c9fcfb74f2d93e05556a6ae854e87d", 0xab}, {&(0x7f0000000880)="35a14ca55d8a35868cda5e68920305579221c3dee10c067a46d68113fffcc3b73be561a87c83a9c030422cf3662517df9ad07550a94dadd89e4299c8b7042828da974b41000480006bea1701ee1b46e9394b50a72d25e70006ce8129432e6658d6d73750895337debcfdcf6d240a785739260c5288f0b42823de97e0620569e8d9a1148aa916adf36aaa", 0x8a}], 0x2, 0x0, 0x0) write$binfmt_script(r12, &(0x7f0000000100), 0xfecc) syz_genetlink_get_family_id$SEG6(&(0x7f0000000200), r12) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r12, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000040)={&(0x7f0000000140)={0x9c, 0x0, 0x8, 0x5, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x6}, @CTA_TIMEOUT_DATA={0x3c, 0x4, 0x0, 0x1, @udp=[@CTA_TIMEOUT_UDP_REPLIED={0x0, 0x2, 0x1, 0x0, 0x7f}, @CTA_TIMEOUT_UDP_UNREPLIED={0x0, 0x1, 0x1, 0x0, 0xbd}]}, @CTA_TIMEOUT_DATA={0x2c, 0x4, 0x0, 0x1, @icmp=[@CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0x6}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8}, @CTA_TIMEOUT_ICMP_TIMEOUT={0x8, 0x1, 0x1, 0x0, 0xffffffff}]}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x3a}, @CTA_TIMEOUT_L4PROTO={0x5}]}, 0x9c}, 0x1, 0x0, 0x0, 0x8000}, 0x40000) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in=@local, @in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x0, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0xee00}, {@in6=@loopback, 0x0, 0x32}, @in=@dev={0xac, 0x14, 0x14, 0x44}, {0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff}, {0x2}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x96}}, 0xf0}, 0x1, 0x0, 0x0, 0x24004040}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, 0xffffffffffffffff, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x12) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r5, 0x11c, 0x1, 0x0, &(0x7f0000000100)) executing program 4: socket$l2tp(0x2, 0x2, 0x73) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6(0xa, 0x3, 0x2f) socket$netlink(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)=""/156, 0x9c}], 0x1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009240)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {}, {0xfff2}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 2: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000540)=[{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f00000000c0)="e4", 0x1}], 0x1, &(0x7f0000000740)=ANY=[@ANYBLOB="300000000000000017e2ffff010000001800000045f43a7ce45002bdb85e47ab3e39597e422ffab456dd963a000000001800000000000000170100000400000006020000004000001800000000000000170100000300000001"], 0x60}], 0x1, 0x0) recvmmsg(r1, &(0x7f0000003500)=[{{0x0, 0x1000000, &(0x7f00000024c0)=[{&(0x7f00000014c0)=""/4096, 0x1000}], 0x1}}], 0x1, 0x0, 0x0) executing program 3: bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000), &(0x7f0000000200)}, 0x38) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000100)="554fd397d1cba737d9832f3b25e6a524b5960428343335c179c752cdca96671092a361f35cf25d582b1ba8c6812dd367a95914b4a0f8f41f9a8eeb2530a9e91dc6745ad34f4e18a490f28bf67c20b241cd15cad034e9ad08b9d1364ff19622bb82b499428cd4892b039d54e9480ff61ead45e5ffda5b71519a709a8644b6ae78d92206854f"}, {&(0x7f0000000340)="8f672e6753e9f33b3c5b6fa3e92d984bee7d3ab020921c638a71fbbfb7278e98409c194d284213c2d98995722afe3adbfa17f30f58339d208090c3458c0fbf145978ad7abe4ffa1ac5ffaf92e7f7aa97c102999f338ef987c62ee0bf6530fcb604"}], 0x0, 0x0, 0xffffffc0, 0x2663}, 0x20000094) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000200)=ANY=[@ANYBLOB="110000001400a10c000000d5b400000002000000", @ANYRES32=0x0], 0x18}, 0x1, 0x0, 0x0, 0x81}, 0x400c800) socket$pppoe(0x18, 0x1, 0x0) socket$inet(0x2, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0xe, 0x4, 0x80005b, 0x10089, 0x2053, 0xffffffffffffffff, 0x3ee, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x1}, 0x48) socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0x33, &(0x7f0000000dc0)=ANY=[@ANYBLOB="b7000000a5517f5fbfa30000000000000703000028feffff720af0fff8ffffff71a4f0ff00000000b7060000000000012e400300000000006506020001cd00007118540000000000c3640000000000006b0a00fe00000000850000002e000000b7000000000000009500000000000000023bc065b7a379d179fc9e94af69912435f1b6a693172e6191a12bebf9f9804ea033388cd15b65877ad4b200000000000000000beca090f32050e436fe275daf51efd601b6bf01c8e8b1abe4fef3bef7074815ae98743d1ace4c46631256dd19aed0d600c0b6199fe3ff3128e599b0eaebbdbd7359a48f5b0afc3996792043a6787bac46aa7aa400000000000069669622208266f896ba2c9e73c2efeec2dc565fbafb2cb63f5fef9ab79ff8abaa8a08f54a062107e9bb3e980fff675c8d3e91df6648a7a6aebcb63e0867b75690152af27711f0cbb9c06018d21bf3f87b8eb65323b4267a526d53442db8e48dbc5ce47d67d07441a7975d5e41b14fd0154a8246249952a8b61633ce068220defe09d3b1136af6d03e9cf996c13d1bfcdc54567a9ca80dec2e943fe4ae7c617cc071f7add70cfbd48f8f6b50fe6a8297d88efa73e7e601040000b4a685969f28902bdecf66ef39755de79ed2c711477febc96231a53984d00877301d0ec62427a8e38618fdd1ce9aaed569ebc5f2e58d6028e66139a737cc7146a131d47dcebb32ed67021d76e983223c998aec22242ae54e87f438d26982876b58f9134366952f7399a733f07138a736924f3709000000e97f0c117ec439c6b7b965752bbc06eced08d97a32ae4b1ad4d11c5b6f68ee841975233e4cea13f3ef04b2cab9cc256d4539dbafd888c7097c1169e0bebcc81ca3da40bf34b6c9c1da2d6ed8acaf2a8091820ff4cf6be74ddca8bf2eed0e11b2139e8c3ec95436af5269d5792decda7d8b5dcf8640b504ba23c6d0a7f67cdfd27328100ebf9319a56f0f9cee17deecf747f3493f1dc39551f4c9a40b3e93fa80b8234ccbf39a9ef09bd97321f0dc20956f44ba2c5ec2e7569b05cf4690ddc189f174046a8b214acf23f42fb51ed4819e6b4cb5a8bf2b559d0c198fe0315483b8beb9801d06c58b22dd713fe3b7ef18e21081aacfd091b754125a488cea18255f79bebcb3051f622f8a1d9af1908e88a58774a24f35a4ccdbedea6212286c23dd89c2b4b90647f17231472af8dda7f3ab20f093aad3ce875f7458039ee6d0a50deb7bc8eb393f056a5e7725531c5485278e0362338e2e2710fe00465e0d182a322091022cf5b814eeb9b3cab21196581e4d92d0b6fe5525285eea359274f1f21d69233bbe94941f10ba292100000000000000000000000000000000c18e93a0c5231779f2ee201e9fe7e63e84b57b5f05ecd278919bad330ffcb594b8255b3085b352ca9533d6c31c1a30158c30352f8a126a65cb6582e58aa641007418611df53a601c3a8fb8d2286e86abf98136f345446730f68f5d6d1817a9e1b09e5650d2599fbe719a45337d29eb3fef5f7f565457660dec6fe903a1c2ea4f40a8ea1c179892afa219fc69a44163f0d731de418e9fd82a8c4661caea674b19242d1840d047882f640ea248457288c5ffb63e857da03ff5c0475c3cfff41c4806f1dc750eb1c45ec3a2a0b064834010604d6f88a29e8e9bda2bc9c18d1b53a08f25d62ccaa46bc0235c830a7b3fe64bc6031b431bcad6b698a1ba6027870ea9e55fafbbf140c5f82a33ee4ac793b989c12a5827a7957f4d8136cf918b7cbf5bc5fc64c8001992536584586edded6f65bdd371ac84fd5cc60ab79b84e9e85a1c54d5666a5d133e95eff121621dff14b9de7a188b8c5387f9da63c2cce405bc44079e34e2db2b275bfbb54841d647338cad74be91144b780cf381a6860f641446ef73bd11d45f5e4df8f3c6440d8425fd7382225cf8c2cada01bf3cd5cbc6a403173e0c89a491c75efc3c21b7825a521c6011945eef94abc3000000000000000000000000000000d71b794e9b4c145caf050429937eef4364d9e1cbe9150bccd9b2e73757f1f5e8ac50736cd3cbc029ede2869642841371bb4b9c1aaa8826889a909e6716b60e4b568b6761f8ccc7d35b0e66357746b10fc481b47e67f1e14408c1ef3e018a5e647e3f607654f3bf82bcfb42be038a272d82f8362944f608b3810000000019fda0b1b607f1ab34194ed954973f7a5accc0938d3364ab07574d0b32fc30f3ab73d012b63ee905e98ab6989ec2c840cd216eb18fedfb3b204e94e170bae930660368d3799c9b1bf7556ac57164966791626f06ad2e332341965f72141ec140b80efd7720ccdaa890b79bc4523386bd66553121543c9a35b7adcf2f6b257fefef1d6e1da2ee94d3f822bf45aad21e5b5a3788ab584090664065af39b0f43968dcd7c5f8e5a8dc6298691423fbf7e8e012260bc62f9422434a547ef7ca37953d435098d9b71edd1a03e46d0ade465d0c0db0a51f9e29cac05e5a04f94e"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, 0x2d, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000000)={0xfffffffd}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x90) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001280)={0x18, 0x3, &(0x7f0000000940)=ANY=[@ANYBLOB="1800000008000000000000000000000095"], &(0x7f0000000240)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000007c0)={&(0x7f0000000780)='contention_end\x00', r0}, 0x10) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000c40)="c10e020022003505d25a806f8c6394f90435fc60040011000a740100053582c137153e37024801", 0x27}], 0x1}, 0x4000) r1 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r1, &(0x7f0000000000)={0x0, 0x92c01eb, &(0x7f0000000080)=[{&(0x7f0000000040)="e03f02003e000b05d25a806c8c6f94f90224fc60100005000a000200053582c137153e37000c0980fc0b10000300", 0x33fe0}], 0x1}, 0x0) executing program 2: r0 = socket(0x2, 0x6, 0x0) connect$rxrpc(r0, &(0x7f0000000480)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, 0x24) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[], 0x7c}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000280)={0x7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xff}, 0x6b) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x75, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x1}, &(0x7f0000000080)=0x18) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000400070a0101000000000000000005000000"], 0x14}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000a00)=ANY=[@ANYBLOB="68010000100013070000030000000000ac1414bb000000000000000000000000ac1414aa00000000000000000000000000000000000000000000000000000000a8c95e370a9a424d0bae70216a4958b3d147782ae1bc117f6b02f60480eb4e", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f00000100000000000000000000000000000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480002006374722d63616d656c6c69612d6165736e69000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000e00fe8800000000000000000000000000011c0004000000000000000000fc00"/288], 0x168}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r8, @ANYBLOB="3c00330080000000080211000001080211000000505050505050000000000002aba519ed06dd895d00000100040600000000"], 0x58}}, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000480)=@mangle={'mangle\x00', 0x44, 0x6, 0x418, 0x2b0, 0x210, 0x2b0, 0x2b0, 0x98, 0x380, 0x380, 0x380, 0x380, 0x380, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x0, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @ECN={0x28}}, {{@ip={@loopback, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@multicast}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x478) ioctl$sock_inet_SIOCSARP(r9, 0x8955, &(0x7f00000000c0)={{0x2, 0x4e22, @empty}, {0x1, @multicast}, 0x8, {0x2, 0x4e21, @empty}, 'syzkaller0\x00'}) r10 = socket$inet_udp(0x2, 0x2, 0x0) r11 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r11, 0x0) openat$cgroup_ro(r11, 0x0, 0x26e1, 0x0) setsockopt$inet_group_source_req(r10, 0x0, 0x2e, &(0x7f0000000480)={0x3, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @loopback}}}, 0x108) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="3400000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0000ebff000a00020411ba67aaaabb0000009c000000000000000000"], 0x34}}, 0x0) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r12, 0x0) executing program 4: r0 = bpf$MAP_CREATE(0x100000000000000, &(0x7f0000000140)=@base={0xa, 0x16, 0xb3, 0x7f}, 0x48) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.current\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000780), 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x7964, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018180000", @ANYRES32=r0, @ANYBLOB="00000000000000006600000000400000180000000000000000000000000000009500000000000000360a000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000060000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0xff5c, &(0x7f0000000340)=""/222}, 0x78) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f00000004c0), 0xffffffffffffffff) r2 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0, 0x11, r2, 0x0) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f00000000c0), 0x10) r4 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000080)={'vcan0\x00', 0x0}) sendmsg$can_bcm(r3, &(0x7f0000000280)={&(0x7f0000000040)={0x1d, r5}, 0x10, &(0x7f0000000180)={&(0x7f0000000200)={0x1, 0x27, 0x0, {0x0, 0x2710}, {0x0, 0x2710}, {}, 0x1, @can={{}, 0x0, 0x0, 0x0, 0x0, "c4f40c848d97a447"}}, 0x48}}, 0x0) r6 = socket$can_raw(0x1d, 0x3, 0x1) bind$can_raw(r6, &(0x7f00000005c0), 0x10) recvmmsg(r6, &(0x7f0000001080)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000001000)=[{&(0x7f0000002ac0)=""/4096, 0x1000}], 0x1}}], 0x2, 0x0, 0x0) sendmsg$DEVLINK_CMD_RATE_NEW(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000000000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000800030000000000c272d5c7e09f69052f0420a1fbfe23e13c58a7f3d9f7ea525b7460bb2e355a3f1903c1a8042a3b3737bb094ec8f08e9b90fdf432e92148f623ebaee3810a42cfd622"], 0x3c}}, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) r8 = socket$kcm(0x10, 0x2, 0x4) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmsg$kcm(r8, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000040)="89000000120081ae08060cdc030000007f03e3f7000000006ee2ffca1b1f1400000004c00e72f750375ed08a56331dbf9ed7815e381ad6e747033a0093b837dc6cc01e32efaec8c7a6ec001210000140020c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece01955fed0009d78f0a947ee2b49e33538afa8af92347514f0b56a20ff27fff", 0x89}], 0x1, 0x0, 0x0, 0xff0f0000}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x26e1, 0x0) r9 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x8, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x4}, 0x48) ioctl$TUNSETCARRIER(r7, 0x400454e2, &(0x7f0000000380)=0x1) close(r9) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@bloom_filter={0x1e, 0x5, 0x200, 0x1f, 0x1105, r9, 0x10001, '\x00', 0x0, r7, 0x1, 0x3, 0x5, 0x8002}, 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r9}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}, @call={0x85, 0x0, 0x0, 0x23}]}, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000ac0)={&(0x7f0000000a80)='ext4_writepages\x00', r10}, 0x10) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) write$cgroup_type(r11, &(0x7f0000000000), 0x9) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.events\x00', 0x275a, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0xa, 0x8, 0x7fe2, 0x1}, 0x48) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=0x0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500020001000000850000002300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={&(0x7f00000010c0)='ext4_ext_remove_space_done\x00', r12}, 0x10) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=@newlink={0x50, 0x10, 0x406, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x18, 0x2, 0x0, 0x1, @val={0x14}}}}, @IFLA_MASTER={0x8, 0x3}]}, 0x50}}, 0x0) executing program 4: syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) (async) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000880)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @NL80211_ATTR_WIPHY_FREQ_HINT={0x8}]}, 0x44}}, 0x0) (async) syz_emit_ethernet(0x68, &(0x7f0000000340)={@broadcast, @dev, @void, {@ipv4={0x800, @gre={{0x5, 0x4, 0x0, 0x0, 0x5a, 0x0, 0x0, 0x0, 0x2f, 0x0, @private=0x9000000, @multicast1}, {{0x0, 0x0, 0x1, 0x0, 0x2, 0x0, 0x0, 0x4, 0x8100, 0x2, 0x0, [], "7f1a"}, {0x0, 0x0, 0x0, 0x0, 0x11}}}}}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000440)=@security={'security\x00', 0x4, 0x4, 0x3b8, 0xffffffff, 0xd0, 0x1a8, 0xd0, 0xffffffff, 0xffffffff, 0x2e8, 0x2e8, 0x2e8, 0xffffffff, 0x7fffffe, 0x0, {[{{@ipv6={@dev, @ipv4={'\x00', '\xff\xff', @multicast1}, [], [], 'bridge_slave_1\x00', 'geneve0\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE2={0x28, 'NFQUEUE\x00', 0x2, {0x0, 0x3}}}, {{@uncond, 0x0, 0xa8, 0xd8}, @common=@unspec=@CONNMARK={0x30}}, {{@ipv6={@private1, @mcast1, [], [], 'geneve1\x00', 'macvlan0\x00'}, 0x0, 0x118, 0x140, 0x0, {}, [@common=@unspec=@helper={{0x48}, {0x0, 'syz0\x00'}}, @common=@ipv6header={{0x28}}]}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x1}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x418) (async) sendmsg$NL80211_CMD_SET_MESH_CONFIG(r0, &(0x7f00000005c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000040)={&(0x7f0000000540)={0x40, r1, 0x200, 0x70bd29, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x1, 0x67}}}}, [@NL80211_ATTR_WIPHY={0x8, 0x1, 0x9}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}, @NL80211_ATTR_WIPHY={0x8, 0x1, 0xf}, @NL80211_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x40}}, 0x8005) socket$inet_sctp(0x2, 0x1, 0x84) (async) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_MSFILTER(r5, 0x0, 0x30, &(0x7f0000010140)=ANY=[], 0x110) (async) connect$netrom(r4, &(0x7f0000000140)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @default, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}, 0x48) (async) r6 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r6, &(0x7f0000000300)={{0x6, @rose}, [@null, @default, @default, @default, @bcast, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}]}, 0x48) (async) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)=@allocspi={0xf8, 0x16, 0x1, 0x0, 0x0, {{{@in, @in6=@mcast1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x33}, @in=@broadcast, {}, {}, {}, 0x0, 0x0, 0xa}}}, 0xf8}}, 0x0) (async) r7 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@netrom={'nr', 0x0}, 0x10) (async) ioctl$sock_netdev_private(r7, 0x8914, &(0x7f0000000000)) (async) sendmsg$NL802154_CMD_GET_INTERFACE(0xffffffffffffffff, &(0x7f0000000980)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000940)={&(0x7f0000000900)=ANY=[@ANYBLOB='\x00\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="040025bd7000fedbdf250500000008000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="08000300", @ANYRES32=0x0, @ANYBLOB="0c0006000300000000000000"], 0x38}, 0x1, 0x0, 0x0, 0x4001}, 0x40004) (async) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, 0x0, 0x0) (async) r8 = syz_genetlink_get_family_id$smc(&(0x7f0000000080), 0xffffffffffffffff) (async) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, 0x0, 0x0) (async) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, 0x0) (async) sendmsg$SMC_PNETID_DEL(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000021c0)={0x20, r8, 0x1, 0x0, 0x0, {0x3, 0x2, 0x2}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}]}, 0x20}, 0x1, 0x40030000000000}, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0) executing program 4: r0 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000080)='pids.current\x00', 0x0, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={r0, 0xe0, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x1, 0x3, &(0x7f0000000100)=[0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0], 0x0, 0x5b, 0x0, 0x0, 0x10, &(0x7f0000000180), &(0x7f00000001c0), 0x8, 0xa9, 0x8, 0x8, &(0x7f0000000200)}}, 0x10) r1 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000000)=0xffffffffffffffff, 0x4) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000002c00)={0x5, 0x5, &(0x7f0000000040)=@framed={{}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x4}]}, &(0x7f0000002b40)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, r1}, 0x90) executing program 2: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="f0000000100001000000000000000000fe880000000000000000000000000001fe80000000000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe800000000000000000000000000000000000002b000000fc0200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000a00"/168], 0xf0}}, 0x0) r1 = socket$xdp(0x2c, 0x3, 0x0) mmap$xdp(&(0x7f0000002000/0x2000)=nil, 0x2000, 0x0, 0x11, r1, 0x0) epoll_create1(0x0) syz_emit_ethernet(0x46, &(0x7f0000000000)={@local, @remote, @void, {@ipv4={0x800, @tcp={{0x9, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x6, 0x0, @private=0xa010100, @local, {[@cipso={0x86, 0xf, 0x3, [{0x1, 0x4, "4492"}, {0x7, 0x5, "e0f493"}]}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB="9feb0100180000000002000014009ed9c34b8e4208e11173870deee618ce00001400000002000000002000000100000d0ba35e508754f6d7be26e86d4e0000000000800000020000000000"], &(0x7f0000001f80)=""/237, 0x2e, 0xed, 0x1}, 0x20) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x2, 0xa, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, [@sadb_x_filter={0x5, 0x1a, @in6=@loopback, @in=@local, 0x0, 0x0, 0x1b5524f0c417548a}]}, 0x38}}, 0x0) r4 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000040)=@framed, &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$PROG_BIND_MAP(0x1c, &(0x7f0000000140)={r4, 0xffffffffffffffff, 0x24}, 0xc) syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000140), r2) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000480)="26d19345d2d4d5f619a46a53cdf385b182611594585965f5d9bec1fbadde417c4e591e14fc3b0f8a140196ba9a9eae64943243727f6751babe5be57a2d0d190f4795f9ce20eb28f88c2e2c7a0b2bbca4de6a4c0718b9b988c6e18de98f1c670c4e0266295e0d0cd46561c0794fcd1bef177e95cb6652be8ebd064c30db4be0ffd2b00d71092247df4471e349eb0540bb6165b0a1b560b5c6968a373eeea43d7707211832fefb1dcfa6aea62d57353eb46335efd4228129657cdbe1d902d8442eb2e8d2cb2ed31840c370f1de92c906c226da78795e5e7c7106e66fc1e04c65a7ac6a405aec2bbbaf110376558b818b4a801abfbc", 0xf4) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r5 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NLBL_UNLABEL_C_ACCEPT(r2, &(0x7f0000000280)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000600)={0x5c, r5, 0x610, 0x70bd2c, 0x25dfdbfb, {}, [@NLBL_UNLABEL_A_IPV6MASK={0x14, 0x3, @remote}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @multicast1}, @NLBL_UNLABEL_A_SECCTX={0x2b, 0x7, 'system_u:object_r:crond_unit_file_t:s0\x00'}]}, 0x5c}, 0x1, 0x0, 0x0, 0x40}, 0x40000) bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x27}, 0x74) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000002180)=[{{&(0x7f00000000c0)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x60, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @crypto_settings=[@NL80211_ATTR_PMK={0x2b, 0xfe, "bacee2aae6d1b417a918fc4aad2a528daf55784d88b55ebe66612e9c26f796a31d127af729f270"}]]}, 0x60}}, 0x0) executing program 3: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newsa={0xf0, 0x10, 0x713, 0x0, 0x0, {{@in=@local, @in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x0, 0x4, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0xee00}, {@in6=@loopback, 0x0, 0x32}, @in=@dev={0xac, 0x14, 0x14, 0x44}, {0x0, 0x0, 0xffffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff}, {0x2}, 0x0, 0x0, 0x2, 0x0, 0x0, 0x96}}, 0xf0}, 0x1, 0x0, 0x0, 0x24004040}, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='memory.events\x00', 0x7a05, 0x1700) write$binfmt_script(0xffffffffffffffff, &(0x7f0000000100), 0xfecc) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, 0xffffffffffffffff, 0x0) write$cgroup_int(r4, &(0x7f0000000200), 0x12) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) getsockopt$inet_mptcp_buf(r5, 0x11c, 0x1, 0x0, &(0x7f0000000100)) executing program 1: openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(0xffffffffffffffff) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000380)=@bridge_delneigh={0x3c, 0x1c, 0xc07, 0x0, 0x0, {0x7, 0x0, 0x0, 0x0, 0x141}, [@NDA_VLAN={0x6, 0x5, 0x1}, @NDA_FDB_EXT_ATTRS={0xc, 0xe, 0x0, 0x1, [@NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0x5}]}, @NDA_LLADDR={0xa, 0x2, @random="000200"}]}, 0x3c}}, 0x0) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40086602, &(0x7f0000000140)) bpf$PROG_LOAD(0x5, 0x0, 0x0) pwritev(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0) write$binfmt_elf64(0xffffffffffffffff, &(0x7f00000007c0)=ANY=[], 0x2a8) shutdown(0xffffffffffffffff, 0x0) setsockopt$WPAN_SECURITY(0xffffffffffffffff, 0x0, 0x1, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0xa, 0x6, &(0x7f0000000000)=ANY=[@ANYBLOB="05acb6aefb00000071114200000000008510000002000000850000007600000095"], 0x0, 0x0, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x6}, 0x90) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x7a05, 0x1700) write$cgroup_int(r2, &(0x7f0000000200), 0x43400) openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x60ff, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001880)=ANY=[@ANYBLOB="b700000012edfffebfa30000000000007603000028feffff7a0af0fff8ffffff61a4f0ff000000005d040000000000007f000000000000002704000001ed0a0066000000170000003e040000000000007b0300fe000000002d03000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efd2a102ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef7054803d0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc532ef58de3c1b7646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff095edc710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf28bf6d8e8afcb913466aaa7f6df70252e79166d85827513acd02b5a655a314d31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f08050e46850600000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040b96e37c4f46010400000000c3da29faf75ddd1aa96960bca97af133824b881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d4cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090df9a2867b3acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236ed200073826593c4e1a0f50a74bb482e486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931485747292c6fe6e188750cf4f87cce2aa7d67c6133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc1caa80e64461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885f69754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8264f7b029b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347926a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd239e4a50d7eb8e327fb5db12cbd6a9efe8e671c4f251cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa232697526e24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f6260a483632a2ab447f88dd6efec73a0271a19ca3aa860aa4dcaeebe3d53040b853a7c02a5fcc08b3a572969bbe91c921ac1476027772c87d172ab29967e38ba49e3e57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c827e02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007fe79d2d25e30830b92fca00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d07d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b53208ad8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f522df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bdaa075fdd88d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb520400000000000000c3ae49f88c462ea2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399fa5ee0b41e14a6fe6894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014fa841061e63d40f4e536314beda57"], &(0x7f00000001c0)='GPL\x00'}, 0x90) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), r3) sendmsg$NLBL_MGMT_C_ADDDEF(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x34, r4, 0x1, 0x0, 0x0, {}, [@NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @multicast2}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, 0x34}}, 0x0) executing program 4: sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) accept(0xffffffffffffffff, 0x0, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000000c0)={&(0x7f0000000100)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x18, 0x18, 0x3, [@array]}, {0x0, [0x0]}}, 0x0, 0x33}, 0x20) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xb, 0x8, 0xc, 0xffffffff, 0x1, 0x1, 0xfffffffd}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000001070000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r1 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000340)={r1, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000000)=ANY=[@ANYBLOB="8801000014"], 0x188}}, 0x0) executing program 2: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0xe, 0x3, &(0x7f0000000000)=@framed={{0x72, 0xa, 0x0, 0xffc4, 0x0, 0x71, 0x10, 0x9, 0xfffffffe}}, &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000001300)=@framed={{}, [@ldst={0x1, 0x0, 0x3, 0x2, 0x1, 0x70}]}, &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xe}, 0x90) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_NUMBER(r0, 0x84, 0x1c, &(0x7f0000000080), &(0x7f00000000c0)=0x4) executing program 3: socket$l2tp(0x2, 0x2, 0x73) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) socket$nl_xfrm(0x10, 0x3, 0x6) socket$inet6(0xa, 0x3, 0x2f) socket$netlink(0x10, 0x3, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) socket$kcm(0x2, 0xa, 0x2) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x0) r0 = socket(0x10, 0x803, 0x0) sendmsg$TIPC_NL_UDP_GET_REMOTEIP(r0, &(0x7f0000000840)={0x0, 0x0, &(0x7f0000000800)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000200)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}}, 0x0) recvmsg(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000380)=""/156, 0x9c}], 0x1}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x44, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009240)={&(0x7f0000000440)=@newtfilter={0x34, 0x2c, 0xd27, 0x0, 0x0, {0x0, 0x0, 0x0, r1, {}, {}, {0xfff2}}, [@filter_kind_options=@f_flow={{0x9}, {0x4}}]}, 0x34}}, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r2, &(0x7f00000002c0), 0x40000000000009f, 0x0) executing program 4: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket(0x200000100000011, 0x803, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'xfrm0\x00'}) executing program 1: r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010", @ANYRES8=0x0, @ANYRESOCT=0x0], 0x48}}, 0x0) ioctl$SIOCPNGETOBJECT(r0, 0x89e0, &(0x7f0000000000)=0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r2) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)={0x30, r7, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_LEVEL={0x14, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x30}}, 0x0) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000001740)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x38, r7, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xffffffffffff0083}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0302}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0102}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0x20000010) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x2c, r3, 0x60b, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5}]}, 0x2c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000001880)=[{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000100)="937a07d330673701d08287fd074fbb692a60d5a4e45edaa2560f28ae2f26fa55dadbfd3420182722a617adf5b2ad34ca1c49d2b43aaa4fdcd727c46b3122ae55b2bb", 0x42}, {&(0x7f00000001c0)="bd4a1cd310c827f04306856cc2ceadec8e8af05d5eb0667a88", 0x19}, {&(0x7f0000000200)="cc3fc2e8423f55f7c6f1705c2f0c4726fa3766ba31b1727f63cd0ccabf1d56bdf48db350a6a69d4bbb0c5ba669d14055ea29213355f5bebf863cd8eb85c880721d76f4de983f95e4fb3d3a0178287b9d4a163e0f68a9f2e4fbdcec016209f16debd4bfeadd9d87b5b517d00b8a565ee7240893e107159d2c7b43b8eb7cd091079d3e94901266684fc29e045ded8e81f538a3943bee97087b27c4bef4fdb7d87f2dbd607c3a7f4598e1831a79fcf3018e51bb62327fe90e9ac823e9d09549b81be01b2abef08e30fe303c4a65286d587eea0a193f0f905c01f305c21a716e6218ed459bf9413d2ea20ebc7b506f831482fa88d36dd5b4", 0xf6}, {&(0x7f0000000300)="a140a67aefc4adb63477db4a5c1e3d474046e5e0d40cc5087844e34a4e02b5889e1349588d4953621512f4805b2bcd810e689bdcf20c4ee2b04836e56a552d049e8315d0d3b3bbc1f0fca8b7de2f39bd22345f4f7c0e13db7e470a069fc49e786de34212f9bd0e25ba29cf1bc8f7ea168eb8ada5dabf4e20450f850f8d0485a4fc9208cadd3dcde9aa0933696cd144966bfad91732d1c75a4ae134ad66ce068cd7fe6980cc9804342fda9c88fe546831e40457e9cd85ed9164c57ac190a74510e9a1ece86d", 0xc5}, {&(0x7f0000000400)="50aa80e8e1d6dd35b35f3b294edeb18ba0ae4abb7cfdf68864d281ba146b609406cf41bf0f90cf4451807af55b7d4906502b2dead0c5692d9edfdf22b2168f89ceb93aa5d785c289c2a89061e31a25825b18d5b5edb32d65f66f6ce035aee7c33c995c0b6df419627d50c17e22a993251750bd435c335391ed408b4a31a5c7d823ca0681023e66f62b8fc71b564076896edd8a33a83b8de9239dbd7e2b73da539d6689495c968b8fe9c9134e5a1fb8468c755b808e475bb7235877cbfc97b4dcd495b62cadd8bf91ffa2fcd90a3228f70ade5f28272b57816f5780a297a4ef3e4f297973424bc943", 0xe8}, {&(0x7f0000000500)="91fc6ae21b733f42467be34f451de56760da3a70c2504ea31849465c5ce1f52c4246548e017b32b196850e5220ed9fdc0cba567cef2030c1b124ccc0948cc2bf103c09a4032942bdd8c88ab89302457d32cedbab0767cc65ac2f68a7ed4717dbd32340684aec003924b3714de572933ed919fffa41ad", 0x76}, {&(0x7f0000000580)="e6ece36aaf5b98d938b399f2dd7ca8ec686fe81e2498c22fe13b97d8c11091fa72ff410f0d3daf0e5fb49f50ab919fbac104030836d109b6e003f7aa004a28e751e583cd30087d918af07b539781b1d74b121f29a33321a098ad82ce5980f5b6ac5bc969", 0x64}, {&(0x7f0000000600)="6ad74a7964240b7a2081dbdd5e151572d08dc5f319f3b2963d5760e97ab5cea7fcb0ab806d85592f1937e1c3372608eb6f4f0b8f9d44425b0b3d65fadefdcb8b4120285bb5d2d65e311dceea58efe9bf097f133d390baf9b1d67caa5bd1ac7b60edd82b0c6d155dd28802a589792f6438ca8403dd4ddc5cbbc2c30bc9c98592e4ab7bb6c10cce18ef5537479908f34ff483d1c29b8f56de81bfa91a70145aebc8cb7cb8a9af0f7d58561dc74483d3116ac459948a0c21e3bb87d37b3399f9f8e1dad2a41e703eefb61c0db2ddfefec5f6125ee3e6e09e636773f838dc6b0c633edd0058652c2d6ff159b7f4b793d9ce8b34072b4b7ecf48d1ecc65749d7965b1444a2bd3991e17c452e900edb6aaaa0a670f9f239d2e2b8d7d5ee7d108eedc30c911034f62f77ee63f79e54a0c17724dd26f8bff1dd40ea38cb0c271ad003a57458f07521b139fc3e953981c1d37759687d9d405304b88020b0add60eafaecc3ca3ca80b48176ad8c349bf4b15159b694db3ccc0ffef4ac820734a6d1f7008873ff68b5bb014200b46a07c76da8100ba0885277ebc5e70fad73bb0d15b85bb76469ccc1ea5eaa6036e294cb194a021ba77e233bbabcbb1a9fa522171010afc4152b6ea9c71e27ff6044235cbb57e1cd15cf85931a9b4699b2ac968c875f7cabf83a28d392a6e420beae98d690059ee9f4deccb47336dcb3be6017eeafbd4d5762166d965913395e1f58db48499353c94927fe10394aaaf1236522b10faf359b96a1bafefce2ecee64e8162ef07daf89310cc08ad50ac1f663824fcb37a159403d8c3ebde969f86e6ef9ecfeb15e021daf0f312d6ac9b095670451d023bdd6ce06ed25338293bc6a983e7e73b76ff6dbc519030c2fffbaea83023323900e4bc981af9333a45591f640002368194285c78d64b8528a0f36f2c49ab9a5a73a50d42da31e1dd5093bda117a62608c14545c5f65ada05295585c46a38cf0acc5b562f98f993fa8c00a9d92924abb903f74e89ea93f3be7a37ad3c2335ffd2640ead6789186469fe8a435eef9f42f958a9f712fda0cc452f98575d067b908faeae157b57187766372b43509dc276c7272deb82bbbbaf7927af6f4d5e2d40ee2338c35942bcc0c90783a510d3117f0affe753bbde585a1ef9b5644626d10f28a0ce0ee56416535b7027ac3501b77076f017fe47444b77a2ca8b2ca4b354136d657a9165241bc6abf4c3605c407032d4ace6e7d4f00ef5f06755c843076bb8f02a533036ce54df92b97de1ed21156e3f5072328e07a5f8510e54fcab14c374e381ce7fa208de9da13b40b7597fe1c8b892e93c941bae361128d995c9acf4071003ad090f019e65221d942d490e2a83e52067c5a4e264b993ead7c9ca4c7492ca2a0c7f8d7f75efa4d39b43f3dda0abd95465c8b6ecb09621c76e841b9a9f709e7f131f3dafc9be7130d59bc587532c2530cf698d5e8bd32332e9d53da3bf3378d2246f3e38a657205ba7a6739094f8f66d400a20529bee6a7d701ecfda3bdaf402c9a7d65e6c92848c3cc04e2fb33b10828f6e5bd2305d87c83b62923780a16b4bc68d20ae1db009d5606c223267d9aca2a10f23e4061f5b55a4d696ae6b812cc7069f51ef9ffec31e353b17c46a5ac0cb22e64103d602303fd8e419121ec8e955e5760a52f2838ff0943beb4ae4af89c3a3a96f961ab4493d4596279e9ce30395fecaab666ee7604cee8218b093307d10716a5a9f3260641dcb3d5e6c416384c9dcffdf9e169fffec093bc9cc83f526f2868556d8059e909842c78c9f77fb1f7e61a7a3e8cd8de7b585109cc2c1a832e3c4d9159789cee8c6b69a06fe575df88187fe0186f2866023dbc2ff614e78377020ad59d12c64d25808e4caa88f665d041aa79338b704ecf4c0cf0e6e1d34329df9dca4762ab1c11de49ac7c9c043e9bf980bc6744a9695b30b8cff55ae48c898364949db5d97d7b945adcb4f7356fce466fb52e0a5cf26defbb5a9a82e7680131bc27eaa4abef879837c61e9d493fb8ed9074b5757327258eb0ee6d18294b900532dba56c9954e1a1d39ee405d5115045509ce8b5cc6a90d9da1d798d07090ea7cd3bab95b5f4eb615318a8368845ad140a738af7fc41ae2ffb85e73db80b4f7fc6b07849667ae53e8b54f8d406777f572298d3476a6dad04f9c476e672f8d08bbf5c3511fdeb5c04a4ebd90c9d2abdfecd3dbb4fdacec7df4ffa831813c7d60462ce1663f857037eca50f73f418a244efad2ccfc0d1376d9bfcc16a5368bac2cdd19343ced9cc5b79dc6aaddfbbb346bc378b6e359be197b8aa211af6e673b928256951486dc87e88492fbe89261aec077482ef337ef27f5fb83e5f4769c33dee864dedcf0f4d97fcca90e583227849baf120ea3dce4a343ad1ac1524e4158afc35da7bb5defbaebb7e456772eedf808e74dcd806d26bae873f6c561909f3b71478eed4aab71c4ee3344f4219fc38978acec25ab81f7d84f12cf6f4de294f7cb881ab0fb1af03f3c718cb7d3cc5d6996d07bdfa082558438ed400333cca2b1b9ee2bfa7e9c0e41f67773ae4526bc48cd3675c3238802ba44263fe51c047e21c4a46730d1561c9b7ba526ce99405065a5f26caf7063e727a73b67292691a0b29c94686326d50697a35289b386672e71b6970ba61d1b68e516c159e2b56119f781fd2ce143c1d629831bfa87978ef67fbb72aab5bd7a890a34188ab7d37c1963a9a6146ae5305d6fb632961cdc6a56edee481be04f1bc040e670a39ad1ab6c071255f684a9cffeb2fce019b6c580da3ad95c2a924114b92073bbad4f3af3b8616c9d74f396fde8cb05c538ee0ac16ee5ab2665994a4d19517038ddc7db89a10545908790d18b09900005215cb87d9b7298403d902412407ef01ade94d12f5c52ac7285d878f5740767d7c145d8452ce80246d6e1c6e92cd81c03e100b55e255415f8d21b891873640d6cde767d51a1823c483f5f2d12f44c97019c6476a49fc03c567ab605fb4925a2fc243b3fae0107e53567afdd84821b9167c970268f37ba3112dc2d93f8776d89f29a667fe02f18b4cfa86ccc0299a5797daf02ab6f64fae279991ebe148e07c4950fb9f96da0586e8c630067f8b7372f72494b53680673caf77c58dddbe177eead1b81969cefc7da8b1cd9de67e96a4daf01b9152ccc6ccd3ff14f291dac91a506a795d1ac9288e8a4cc682b8625eeb699ab3d6496f53dde1005329a4f26992e2937260a031e4cb4579f3b6db63e4d3d2ad6739af9d64b45e5e7f8fe13dd3c36d46145c3cf176539ea301645afb05c8b5e9d22e677809e2f9134218d38ae0b1b5108129088d79df1022e7d9d70f0c276dccc2c5902497d0a46f92a7a2d5220be23b96030c40e26a0a8361b386b8f7202f2ff6807d25fbaf6012fe63bdbc6789305160e96d2c804f0a6d5ffb596b2bb93b9e7a66afe01f3cd2bf079b2e8ae055aa03c38530bd50afd4f191972a53c25332bce364baa204cecc6ff89e57e906a99b935dfa281d9cd1ad69d896436b0f849488fd0e2b08461c4f77c50aba4916c86482699380bac77ef67f5bec9a227e0ba3fbe8b11fb104c2f0d0fa1a888f5ec115cb68797bb84d375ea00545e5a900d09d1b418c1660a2092aadc38fb5c793b3d46d19bf47534bf977088391da73440e7d423ac497c307402aeedd7042e6ac621b44c97e4456d3bc4852a7e7ea69a1e43e928d39c318e1d2e8892f008970100d798398499f484e1bd47e72d4ccaac423b9cc89a8f9d26aaa93670af10ac72e749d438d7bd24ca5201cce2e6df68a3e28c8415cb5ccc36edfdc2b25f18390ab018722054f81c703e3bfc8b1d9ca7253516e704b2ece2dc016167f52f14cbdaef116766fdd45ca205725476cd1e679a31d253296c5eea4c0adfe6f43181dba44afad3af0fb111c949217d644863355a0ada255ad2089d068ef18886a3c347b9fc85b9e9a7f8b2437ec8920d77aa6fc0255e6aa809efae3f4fdaf242de203fd28eba25535aa5b13dd4bbbf84ba90d4c6c6da3f0ff6c8c0d1f1ef88cfb156ba48e9479f79f548dbf51928cf17195d3a1d116fccf1b13ee9833b4bc9c7c4cd954fb8478b1f32d6ba7e4274cdb400b636e44e2bae1bd47e703fcad79530d53119f6d326ace28c59a6f26094d94cb64ec108fe35e7071f5f4db2e9e335ee702f7d73bf438496a644345a27e02c404fd018fb719ce49e896741898a853517054aeed7e368d0573586eb198ca997733d8a943dedd210cf6ec024079816a23ab298e4e02d46f861b03f26ef3cb1a5e6b9d8348747f4d28a19fdc305967521f71721114ab4ab066daddddda7f3de1a91f9590f7ced2843f03542290f3045b81bf2f64aca59de943a5a8bc96b4a26788ba714e1381bc749f6460b3a12f2dc3800206f32414d0f00d848027538c169d54789637eaaf318f62a9bf0591824163870bf9243162e7e1654896cb3cd09254c1e161f5da2499a0b93e098e0db10fd50f6bf5d3f6211950d4a1049a32fc74b6fce4e7c655adeb74a492c088a2af51f72a050e4a9872ab2827eeb64bc79777f1db45d26c99bb7a87c6832e7d25188a0831c48e6e119d319c669287dec3336c26c5263cfe7310370216ae6c2ad95b2b32a3683ea0d7b87b20af88c838a76196509990a2b3cd77cb15cb3ce7c7604ed0f64050ee2d2f4afba253782367df13182f04f83ce4656519bbfc94a80b9df095bd339a6b523ee9e448f31c481f42e7184cc753a5a907cacbd07f08934c7d43b312aba1d82b93c22ff7659b757d473446030707365b93d1b7269d2d0d518f43a49e0890ad11d6b20ad02ae135e33d7e0b623a01b1f6268748916103427ac03a80b682a4e55e1ec6c7eed563991d6c596c0720b979413f63c40950412d12ba50f500b112508c55ea27e314f81f80da353c4269c0d8af1cae6f7a433bdd4e7e7c54136d281f26681d332b7af4eed6614d6566483d28fcb2f4571259ae7a8adb70adc0341937db6ba57a052adc48dc50e3a9bffd08554f2fbb16eb92a47ca4674694f4379c8879efc1af148030802d69df5094fa3d517ee44918448ae9ed3bff88676a9f58a729629bf21f2f54035aa3688a0df00c43af301c0af13ee01e8998c3523cf8f1e2f4acdb3952ec83fb0240485e127d4824219f131058990577a6d6ae87657579194a06dd821d007b0ae8d0cd244ebe9d21a5dfa93649d37f04c5d642d98d216a655e9bc4708c370abfd82f63a20871f3f3f8e0da3a675336163b4c9a1ced0a26ac9d561053d28dd168819fd0ee497947493a3b867a898cd3fdb1021c98c34d63e509120390d4c2da071a1e11d115f5ce1ef94b01bded6a8482fc88702275d13e101f1dcb452cb45e49ac874f26aaa51ce08d89561a1f97eb65eb8ca1dad4c40c53eec1dae33eda48ef443bde37703a0a0822356a497697aeada646f4e8825988ab621b16e57fd712c7b06f6caf2d90dc571b3a9a9d09cd9b7eddb6ce9a2d762fac1b68ac3dba790719c6ea2f14ebcd9aa5af6b77f0048fd44a5b51103e9e626c75546b9bb563d0bc6c57b9efde8b5eb25e7eb020987eb2a986a8d9668a57e82af0608ec4f12a661c9e46acee8ea1e0c7136d286695f095ca573d1ce2754da94a1f86bb0fd2a002c9b45e70939e24f54082406f0d36f1ff9b22f8c4436ef6da275820ec4656a46bc1b73b2f0d7fd3c4ff590c905b95f1d80554c7549ec753b9da2d3cbf13f0935003a1ef55f578432e4b804f82e2d5956de17103fd7d50d7bcf5a83577b03a2e18b76b4020c8e443959c", 0x1000}], 0x8, 0x0, 0x0, 0x240108c4}, {0x0, 0x0, &(0x7f0000001740), 0x0, &(0x7f0000001780)=[@iv={0xe0, 0x117, 0x2, 0xcb, "676ba5796f8a0df7f9139d0e8b891df12b376c0a83f2c5e9922c94fccc38c923902a246f868d7d099aa03d2a5ef4d100e7ccfc98de832bf6a73946add30d17fa7a43c9673eee8972e38269dbe8d660d6b56266d66310d3ebc6ca1e0630e3bcf139c60116686d5cb88b32a77aa6ce732d06180180d2b57f92a5e873b7537d72fd56ff49ed820e8016202c6fcfa1a3299b9fdd9e76fe24f246c8d2ff27564119dbd437b34b0104719a3453a489ba40b6b9bd72184e3ae66044ef5e56907749ffbb92231fe2b648a82324fec2"}], 0xe0, 0x41}], 0x2, 0x0) executing program 2: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000005040)={0x0, 0x60000000, &(0x7f0000005000)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x3, 0x0, 0x0, {0x1}}], {0x14}}, 0x3c}}, 0x0) executing program 3: r0 = socket(0x2, 0x6, 0x0) connect$rxrpc(r0, &(0x7f0000000480)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, 0x24) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[], 0x7c}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000280)={0x7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xff}, 0x6b) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x75, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x1}, &(0x7f0000000080)=0x18) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000400070a0101000000000000000005000000"], 0x14}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000a00)=ANY=[@ANYBLOB="68010000100013070000030000000000ac1414bb000000000000000000000000ac1414aa00000000000000000000000000000000000000000000000000000000a8c95e370a9a424d0bae70216a4958b3d147782ae1bc117f6b02f60480eb4e", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f00000100000000000000000000000000000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480002006374722d63616d656c6c69612d6165736e69000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000e00fe8800000000000000000000000000011c0004000000000000000000fc00"/288], 0x168}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r8, @ANYBLOB="3c00330080000000080211000001080211000000505050505050000000000002aba519ed06dd895d00000100040600000000"], 0x58}}, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000480)=@mangle={'mangle\x00', 0x44, 0x6, 0x418, 0x2b0, 0x210, 0x2b0, 0x2b0, 0x98, 0x380, 0x380, 0x380, 0x380, 0x380, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x0, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @ECN={0x28}}, {{@ip={@loopback, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@multicast}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x478) ioctl$sock_inet_SIOCSARP(r9, 0x8955, &(0x7f00000000c0)={{0x2, 0x4e22, @empty}, {0x1, @multicast}, 0x8, {0x2, 0x4e21, @empty}, 'syzkaller0\x00'}) r10 = socket$inet_udp(0x2, 0x2, 0x0) r11 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r11, 0x0) openat$cgroup_ro(r11, 0x0, 0x26e1, 0x0) setsockopt$inet_group_source_req(r10, 0x0, 0x2e, &(0x7f0000000480)={0x3, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @loopback}}}, 0x108) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="3400000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0000ebff000a00020411ba67aaaabb0000009c000000000000000000"], 0x34}}, 0x0) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r12, 0x0) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-connect$rxrpc-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-shutdown-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS-sendmsg$NFT_MSG_GETRULE-socket$nl_route-socket$nl_generic-syz_genetlink_get_family_id$nl80211-socket$nl_xfrm-sendmsg$nl_xfrm-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_FRAME-socket$inet_tcp-setsockopt$IPT_SO_SET_REPLACE-ioctl$sock_inet_SIOCSARP-socket$inet_udp-openat$cgroup_ro-mmap-openat$cgroup_ro-setsockopt$inet_group_source_req-sendmsg$nl_route-socket$inet6_tcp-listen detailed listing: executing program 0: r0 = socket(0x2, 0x6, 0x0) connect$rxrpc(r0, &(0x7f0000000480)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, 0x24) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[], 0x7c}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r2, 0x84, 0xb, &(0x7f0000000280)={0x7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x2b, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xff}, 0x6b) shutdown(r2, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r2, 0x84, 0x75, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x1}, &(0x7f0000000080)=0x18) sendmsg$NFT_MSG_GETRULE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000400070a0101000000000000000005000000"], 0x14}}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000a00)=ANY=[@ANYBLOB="68010000100013070000030000000000ac1414bb000000000000000000000000ac1414aa00000000000000000000000000000000000000000000000000000000a8c95e370a9a424d0bae70216a4958b3d147782ae1bc117f6b02f60480eb4e", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f00000100000000000000000000000000000000330000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000480002006374722d63616d656c6c69612d6165736e69000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000014000e00fe8800000000000000000000000000011c0004000000000000000000fc00"/288], 0x168}}, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r8, @ANYBLOB="3c00330080000000080211000001080211000000505050505050000000000002aba519ed06dd895d00000100040600000000"], 0x58}}, 0x0) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f0000000480)=@mangle={'mangle\x00', 0x44, 0x6, 0x418, 0x2b0, 0x210, 0x2b0, 0x2b0, 0x98, 0x380, 0x380, 0x380, 0x380, 0x380, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x0, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @ECN={0x28}}, {{@ip={@loopback, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @empty}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@multicast}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x478) ioctl$sock_inet_SIOCSARP(r9, 0x8955, &(0x7f00000000c0)={{0x2, 0x4e22, @empty}, {0x1, @multicast}, 0x8, {0x2, 0x4e21, @empty}, 'syzkaller0\x00'}) r10 = socket$inet_udp(0x2, 0x2, 0x0) r11 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r11, 0x0) openat$cgroup_ro(r11, 0x0, 0x26e1, 0x0) setsockopt$inet_group_source_req(r10, 0x0, 0x2e, &(0x7f0000000480)={0x3, {{0x2, 0x0, @multicast2}}, {{0x2, 0x0, @loopback}}}, 0x108) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="3400000010005fba00"/20, @ANYRES32=0x0, @ANYBLOB="0000ebff000a00020411ba67aaaabb0000009c000000000000000000"], 0x34}}, 0x0) r12 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r12, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000005040)={0x0, 0x60000000, &(0x7f0000005000)={&(0x7f0000000540)={{0x14}, [@NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x3, 0x0, 0x0, {0x1}}], {0x14}}, 0x3c}}, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-sendmsg$nl_route-ioctl$SIOCPNGETOBJECT-syz_init_net_socket$nl_generic-syz_init_net_socket$nl_generic-syz_genetlink_get_family_id$ieee802154-ioctl$sock_SIOCGIFINDEX_802154-syz_init_net_socket$nl_generic-ioctl$sock_SIOCGIFINDEX_802154-syz_genetlink_get_family_id$nl802154-sendmsg$NL802154_CMD_DEL_SEC_LEVEL-sendmsg$NL802154_CMD_NEW_INTERFACE-syz_init_net_socket$nl_generic-sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL-sendmmsg$alg detailed listing: executing program 0: r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010001fff0000056800080000faff0000", @ANYRES32=0x0, @ANYBLOB="c30c424700000000280012800a00010076786c616e00000018000280140010", @ANYRES8=0x0, @ANYRESOCT=0x0], 0x48}}, 0x0) ioctl$SIOCPNGETOBJECT(r0, 0x89e0, &(0x7f0000000000)=0x2) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r2) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) r7 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NL802154_CMD_DEL_SEC_LEVEL(r5, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000000c0)={0x30, r7, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_SEC_LEVEL={0x14, 0x2d, 0x0, 0x1, [@NL802154_SECLEVEL_ATTR_LEVELS={0x5}, @NL802154_SECLEVEL_ATTR_FRAME={0x8}]}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}]}, 0x30}}, 0x0) sendmsg$NL802154_CMD_NEW_INTERFACE(r1, &(0x7f0000001740)={&(0x7f0000001680)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000001700)={&(0x7f00000016c0)={0x38, r7, 0x100, 0x70bd2b, 0x25dfdbff, {}, [@NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xffffffffffff0083}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0302}}, @NL802154_ATTR_EXTENDED_ADDR={0xc, 0x17, {0xaaaaaaaaaaaa0102}}]}, 0x38}, 0x1, 0x0, 0x0, 0xc000}, 0x20000010) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000000c0)={0x2c, r3, 0x60b, 0x0, 0x0, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5}]}, 0x2c}}, 0x0) sendmmsg$alg(r0, &(0x7f0000001880)=[{0x0, 0x0, &(0x7f0000001600)=[{&(0x7f0000000100)="937a07d330673701d08287fd074fbb692a60d5a4e45edaa2560f28ae2f26fa55dadbfd3420182722a617adf5b2ad34ca1c49d2b43aaa4fdcd727c46b3122ae55b2bb", 0x42}, {&(0x7f00000001c0)="bd4a1cd310c827f04306856cc2ceadec8e8af05d5eb0667a88", 0x19}, {&(0x7f0000000200)="cc3fc2e8423f55f7c6f1705c2f0c4726fa3766ba31b1727f63cd0ccabf1d56bdf48db350a6a69d4bbb0c5ba669d14055ea29213355f5bebf863cd8eb85c880721d76f4de983f95e4fb3d3a0178287b9d4a163e0f68a9f2e4fbdcec016209f16debd4bfeadd9d87b5b517d00b8a565ee7240893e107159d2c7b43b8eb7cd091079d3e94901266684fc29e045ded8e81f538a3943bee97087b27c4bef4fdb7d87f2dbd607c3a7f4598e1831a79fcf3018e51bb62327fe90e9ac823e9d09549b81be01b2abef08e30fe303c4a65286d587eea0a193f0f905c01f305c21a716e6218ed459bf9413d2ea20ebc7b506f831482fa88d36dd5b4", 0xf6}, {&(0x7f0000000300)="a140a67aefc4adb63477db4a5c1e3d474046e5e0d40cc5087844e34a4e02b5889e1349588d4953621512f4805b2bcd810e689bdcf20c4ee2b04836e56a552d049e8315d0d3b3bbc1f0fca8b7de2f39bd22345f4f7c0e13db7e470a069fc49e786de34212f9bd0e25ba29cf1bc8f7ea168eb8ada5dabf4e20450f850f8d0485a4fc9208cadd3dcde9aa0933696cd144966bfad91732d1c75a4ae134ad66ce068cd7fe6980cc9804342fda9c88fe546831e40457e9cd85ed9164c57ac190a74510e9a1ece86d", 0xc5}, {&(0x7f0000000400)="50aa80e8e1d6dd35b35f3b294edeb18ba0ae4abb7cfdf68864d281ba146b609406cf41bf0f90cf4451807af55b7d4906502b2dead0c5692d9edfdf22b2168f89ceb93aa5d785c289c2a89061e31a25825b18d5b5edb32d65f66f6ce035aee7c33c995c0b6df419627d50c17e22a993251750bd435c335391ed408b4a31a5c7d823ca0681023e66f62b8fc71b564076896edd8a33a83b8de9239dbd7e2b73da539d6689495c968b8fe9c9134e5a1fb8468c755b808e475bb7235877cbfc97b4dcd495b62cadd8bf91ffa2fcd90a3228f70ade5f28272b57816f5780a297a4ef3e4f297973424bc943", 0xe8}, {&(0x7f0000000500)="91fc6ae21b733f42467be34f451de56760da3a70c2504ea31849465c5ce1f52c4246548e017b32b196850e5220ed9fdc0cba567cef2030c1b124ccc0948cc2bf103c09a4032942bdd8c88ab89302457d32cedbab0767cc65ac2f68a7ed4717dbd32340684aec003924b3714de572933ed919fffa41ad", 0x76}, {&(0x7f0000000580)="e6ece36aaf5b98d938b399f2dd7ca8ec686fe81e2498c22fe13b97d8c11091fa72ff410f0d3daf0e5fb49f50ab919fbac104030836d109b6e003f7aa004a28e751e583cd30087d918af07b539781b1d74b121f29a33321a098ad82ce5980f5b6ac5bc969", 0x64}, {&(0x7f0000000600)="6ad74a7964240b7a2081dbdd5e151572d08dc5f319f3b2963d5760e97ab5cea7fcb0ab806d85592f1937e1c3372608eb6f4f0b8f9d44425b0b3d65fadefdcb8b4120285bb5d2d65e311dceea58efe9bf097f133d390baf9b1d67caa5bd1ac7b60edd82b0c6d155dd28802a589792f6438ca8403dd4ddc5cbbc2c30bc9c98592e4ab7bb6c10cce18ef5537479908f34ff483d1c29b8f56de81bfa91a70145aebc8cb7cb8a9af0f7d58561dc74483d3116ac459948a0c21e3bb87d37b3399f9f8e1dad2a41e703eefb61c0db2ddfefec5f6125ee3e6e09e636773f838dc6b0c633edd0058652c2d6ff159b7f4b793d9ce8b34072b4b7ecf48d1ecc65749d7965b1444a2bd3991e17c452e900edb6aaaa0a670f9f239d2e2b8d7d5ee7d108eedc30c911034f62f77ee63f79e54a0c17724dd26f8bff1dd40ea38cb0c271ad003a57458f07521b139fc3e953981c1d37759687d9d405304b88020b0add60eafaecc3ca3ca80b48176ad8c349bf4b15159b694db3ccc0ffef4ac820734a6d1f7008873ff68b5bb014200b46a07c76da8100ba0885277ebc5e70fad73bb0d15b85bb76469ccc1ea5eaa6036e294cb194a021ba77e233bbabcbb1a9fa522171010afc4152b6ea9c71e27ff6044235cbb57e1cd15cf85931a9b4699b2ac968c875f7cabf83a28d392a6e420beae98d690059ee9f4deccb47336dcb3be6017eeafbd4d5762166d965913395e1f58db48499353c94927fe10394aaaf1236522b10faf359b96a1bafefce2ecee64e8162ef07daf89310cc08ad50ac1f663824fcb37a159403d8c3ebde969f86e6ef9ecfeb15e021daf0f312d6ac9b095670451d023bdd6ce06ed25338293bc6a983e7e73b76ff6dbc519030c2fffbaea83023323900e4bc981af9333a45591f640002368194285c78d64b8528a0f36f2c49ab9a5a73a50d42da31e1dd5093bda117a62608c14545c5f65ada05295585c46a38cf0acc5b562f98f993fa8c00a9d92924abb903f74e89ea93f3be7a37ad3c2335ffd2640ead6789186469fe8a435eef9f42f958a9f712fda0cc452f98575d067b908faeae157b57187766372b43509dc276c7272deb82bbbbaf7927af6f4d5e2d40ee2338c35942bcc0c90783a510d3117f0affe753bbde585a1ef9b5644626d10f28a0ce0ee56416535b7027ac3501b77076f017fe47444b77a2ca8b2ca4b354136d657a9165241bc6abf4c3605c407032d4ace6e7d4f00ef5f06755c843076bb8f02a533036ce54df92b97de1ed21156e3f5072328e07a5f8510e54fcab14c374e381ce7fa208de9da13b40b7597fe1c8b892e93c941bae361128d995c9acf4071003ad090f019e65221d942d490e2a83e52067c5a4e264b993ead7c9ca4c7492ca2a0c7f8d7f75efa4d39b43f3dda0abd95465c8b6ecb09621c76e841b9a9f709e7f131f3dafc9be7130d59bc587532c2530cf698d5e8bd32332e9d53da3bf3378d2246f3e38a657205ba7a6739094f8f66d400a20529bee6a7d701ecfda3bdaf402c9a7d65e6c92848c3cc04e2fb33b10828f6e5bd2305d87c83b62923780a16b4bc68d20ae1db009d5606c223267d9aca2a10f23e4061f5b55a4d696ae6b812cc7069f51ef9ffec31e353b17c46a5ac0cb22e64103d602303fd8e419121ec8e955e5760a52f2838ff0943beb4ae4af89c3a3a96f961ab4493d4596279e9ce30395fecaab666ee7604cee8218b093307d10716a5a9f3260641dcb3d5e6c416384c9dcffdf9e169fffec093bc9cc83f526f2868556d8059e909842c78c9f77fb1f7e61a7a3e8cd8de7b585109cc2c1a832e3c4d9159789cee8c6b69a06fe575df88187fe0186f2866023dbc2ff614e78377020ad59d12c64d25808e4caa88f665d041aa79338b704ecf4c0cf0e6e1d34329df9dca4762ab1c11de49ac7c9c043e9bf980bc6744a9695b30b8cff55ae48c898364949db5d97d7b945adcb4f7356fce466fb52e0a5cf26defbb5a9a82e7680131bc27eaa4abef879837c61e9d493fb8ed9074b5757327258eb0ee6d18294b900532dba56c9954e1a1d39ee405d5115045509ce8b5cc6a90d9da1d798d07090ea7cd3bab95b5f4eb615318a8368845ad140a738af7fc41ae2ffb85e73db80b4f7fc6b07849667ae53e8b54f8d406777f572298d3476a6dad04f9c476e672f8d08bbf5c3511fdeb5c04a4ebd90c9d2abdfecd3dbb4fdacec7df4ffa831813c7d60462ce1663f857037eca50f73f418a244efad2ccfc0d1376d9bfcc16a5368bac2cdd19343ced9cc5b79dc6aaddfbbb346bc378b6e359be197b8aa211af6e673b928256951486dc87e88492fbe89261aec077482ef337ef27f5fb83e5f4769c33dee864dedcf0f4d97fcca90e583227849baf120ea3dce4a343ad1ac1524e4158afc35da7bb5defbaebb7e456772eedf808e74dcd806d26bae873f6c561909f3b71478eed4aab71c4ee3344f4219fc38978acec25ab81f7d84f12cf6f4de294f7cb881ab0fb1af03f3c718cb7d3cc5d6996d07bdfa082558438ed400333cca2b1b9ee2bfa7e9c0e41f67773ae4526bc48cd3675c3238802ba44263fe51c047e21c4a46730d1561c9b7ba526ce99405065a5f26caf7063e727a73b67292691a0b29c94686326d50697a35289b386672e71b6970ba61d1b68e516c159e2b56119f781fd2ce143c1d629831bfa87978ef67fbb72aab5bd7a890a34188ab7d37c1963a9a6146ae5305d6fb632961cdc6a56edee481be04f1bc040e670a39ad1ab6c071255f684a9cffeb2fce019b6c580da3ad95c2a924114b92073bbad4f3af3b8616c9d74f396fde8cb05c538ee0ac16ee5ab2665994a4d19517038ddc7db89a10545908790d18b09900005215cb87d9b7298403d902412407ef01ade94d12f5c52ac7285d878f5740767d7c145d8452ce80246d6e1c6e92cd81c03e100b55e255415f8d21b891873640d6cde767d51a1823c483f5f2d12f44c97019c6476a49fc03c567ab605fb4925a2fc243b3fae0107e53567afdd84821b9167c970268f37ba3112dc2d93f8776d89f29a667fe02f18b4cfa86ccc0299a5797daf02ab6f64fae279991ebe148e07c4950fb9f96da0586e8c630067f8b7372f72494b53680673caf77c58dddbe177eead1b81969cefc7da8b1cd9de67e96a4daf01b9152ccc6ccd3ff14f291dac91a506a795d1ac9288e8a4cc682b8625eeb699ab3d6496f53dde1005329a4f26992e2937260a031e4cb4579f3b6db63e4d3d2ad6739af9d64b45e5e7f8fe13dd3c36d46145c3cf176539ea301645afb05c8b5e9d22e677809e2f9134218d38ae0b1b5108129088d79df1022e7d9d70f0c276dccc2c5902497d0a46f92a7a2d5220be23b96030c40e26a0a8361b386b8f7202f2ff6807d25fbaf6012fe63bdbc6789305160e96d2c804f0a6d5ffb596b2bb93b9e7a66afe01f3cd2bf079b2e8ae055aa03c38530bd50afd4f191972a53c25332bce364baa204cecc6ff89e57e906a99b935dfa281d9cd1ad69d896436b0f849488fd0e2b08461c4f77c50aba4916c86482699380bac77ef67f5bec9a227e0ba3fbe8b11fb104c2f0d0fa1a888f5ec115cb68797bb84d375ea00545e5a900d09d1b418c1660a2092aadc38fb5c793b3d46d19bf47534bf977088391da73440e7d423ac497c307402aeedd7042e6ac621b44c97e4456d3bc4852a7e7ea69a1e43e928d39c318e1d2e8892f008970100d798398499f484e1bd47e72d4ccaac423b9cc89a8f9d26aaa93670af10ac72e749d438d7bd24ca5201cce2e6df68a3e28c8415cb5ccc36edfdc2b25f18390ab018722054f81c703e3bfc8b1d9ca7253516e704b2ece2dc016167f52f14cbdaef116766fdd45ca205725476cd1e679a31d253296c5eea4c0adfe6f43181dba44afad3af0fb111c949217d644863355a0ada255ad2089d068ef18886a3c347b9fc85b9e9a7f8b2437ec8920d77aa6fc0255e6aa809efae3f4fdaf242de203fd28eba25535aa5b13dd4bbbf84ba90d4c6c6da3f0ff6c8c0d1f1ef88cfb156ba48e9479f79f548dbf51928cf17195d3a1d116fccf1b13ee9833b4bc9c7c4cd954fb8478b1f32d6ba7e4274cdb400b636e44e2bae1bd47e703fcad79530d53119f6d326ace28c59a6f26094d94cb64ec108fe35e7071f5f4db2e9e335ee702f7d73bf438496a644345a27e02c404fd018fb719ce49e896741898a853517054aeed7e368d0573586eb198ca997733d8a943dedd210cf6ec024079816a23ab298e4e02d46f861b03f26ef3cb1a5e6b9d8348747f4d28a19fdc305967521f71721114ab4ab066daddddda7f3de1a91f9590f7ced2843f03542290f3045b81bf2f64aca59de943a5a8bc96b4a26788ba714e1381bc749f6460b3a12f2dc3800206f32414d0f00d848027538c169d54789637eaaf318f62a9bf0591824163870bf9243162e7e1654896cb3cd09254c1e161f5da2499a0b93e098e0db10fd50f6bf5d3f6211950d4a1049a32fc74b6fce4e7c655adeb74a492c088a2af51f72a050e4a9872ab2827eeb64bc79777f1db45d26c99bb7a87c6832e7d25188a0831c48e6e119d319c669287dec3336c26c5263cfe7310370216ae6c2ad95b2b32a3683ea0d7b87b20af88c838a76196509990a2b3cd77cb15cb3ce7c7604ed0f64050ee2d2f4afba253782367df13182f04f83ce4656519bbfc94a80b9df095bd339a6b523ee9e448f31c481f42e7184cc753a5a907cacbd07f08934c7d43b312aba1d82b93c22ff7659b757d473446030707365b93d1b7269d2d0d518f43a49e0890ad11d6b20ad02ae135e33d7e0b623a01b1f6268748916103427ac03a80b682a4e55e1ec6c7eed563991d6c596c0720b979413f63c40950412d12ba50f500b112508c55ea27e314f81f80da353c4269c0d8af1cae6f7a433bdd4e7e7c54136d281f26681d332b7af4eed6614d6566483d28fcb2f4571259ae7a8adb70adc0341937db6ba57a052adc48dc50e3a9bffd08554f2fbb16eb92a47ca4674694f4379c8879efc1af148030802d69df5094fa3d517ee44918448ae9ed3bff88676a9f58a729629bf21f2f54035aa3688a0df00c43af301c0af13ee01e8998c3523cf8f1e2f4acdb3952ec83fb0240485e127d4824219f131058990577a6d6ae87657579194a06dd821d007b0ae8d0cd244ebe9d21a5dfa93649d37f04c5d642d98d216a655e9bc4708c370abfd82f63a20871f3f3f8e0da3a675336163b4c9a1ced0a26ac9d561053d28dd168819fd0ee497947493a3b867a898cd3fdb1021c98c34d63e509120390d4c2da071a1e11d115f5ce1ef94b01bded6a8482fc88702275d13e101f1dcb452cb45e49ac874f26aaa51ce08d89561a1f97eb65eb8ca1dad4c40c53eec1dae33eda48ef443bde37703a0a0822356a497697aeada646f4e8825988ab621b16e57fd712c7b06f6caf2d90dc571b3a9a9d09cd9b7eddb6ce9a2d762fac1b68ac3dba790719c6ea2f14ebcd9aa5af6b77f0048fd44a5b51103e9e626c75546b9bb563d0bc6c57b9efde8b5eb25e7eb020987eb2a986a8d9668a57e82af0608ec4f12a661c9e46acee8ea1e0c7136d286695f095ca573d1ce2754da94a1f86bb0fd2a002c9b45e70939e24f54082406f0d36f1ff9b22f8c4436ef6da275820ec4656a46bc1b73b2f0d7fd3c4ff590c905b95f1d80554c7549ec753b9da2d3cbf13f0935003a1ef55f578432e4b804f82e2d5956de17103fd7d50d7bcf5a83577b03a2e18b76b4020c8e443959c", 0x1000}], 0x8, 0x0, 0x0, 0x240108c4}, {0x0, 0x0, &(0x7f0000001740), 0x0, &(0x7f0000001780)=[@iv={0xe0, 0x117, 0x2, 0xcb, "676ba5796f8a0df7f9139d0e8b891df12b376c0a83f2c5e9922c94fccc38c923902a246f868d7d099aa03d2a5ef4d100e7ccfc98de832bf6a73946add30d17fa7a43c9673eee8972e38269dbe8d660d6b56266d66310d3ebc6ca1e0630e3bcf139c60116686d5cb88b32a77aa6ce732d06180180d2b57f92a5e873b7537d72fd56ff49ed820e8016202c6fcfa1a3299b9fdd9e76fe24f246c8d2ff27564119dbd437b34b0104719a3453a489ba40b6b9bd72184e3ae66044ef5e56907749ffbb92231fe2b648a82324fec2"}], 0xe0, 0x41}], 0x2, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211-bind$alg-socket-socket$packet-ioctl$sock_SIOCGIFINDEX detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket(0x200000100000011, 0x803, 0x0) r7 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000040)={'xfrm0\x00'}) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211-bind$alg-socket-socket$packet detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket(0x200000100000011, 0x803, 0x0) socket$packet(0x11, 0x2, 0x300) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211-bind$alg-socket detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) socket(0x200000100000011, 0x803, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211-bind$alg detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp-getsockopt$bt_BT_SECURITY-ioctl$sock_SIOCGIFINDEX_80211 detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8b0f, 0x0) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp-getsockopt$bt_BT_SECURITY detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) getsockopt$bt_BT_SECURITY(r4, 0x111, 0x5, 0x0, 0x20001f00) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$pppl2tp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-syz_init_net_socket$bt_sco-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-bpf$PROG_LOAD_XDP-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0x12, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="180000914d00000000000000000000008500000031000000fb72000000000000"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8}, 0x90) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) sendmsg$NFT_BATCH(r3, 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, 0x0, 0x0) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Read in l2tp_tunnel_del_work testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_TP_METER_CANCEL-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) sendmsg$BATADV_CMD_TP_METER_CANCEL(0xffffffffffffffff, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x24, r2, 0x8, 0x70bd2a, 0x25dfdbfe, {}, [@BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x2}, @BATADV_ATTR_VLANID={0x6, 0x28, 0x3}]}, 0x24}}, 0x4000000) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$pppl2tp(0x18, 0x1, 0x1) r5 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r4, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r5, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-syz_genetlink_get_family_id$batadv-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-bpf$PROG_LOAD-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x0, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-bpf$PROG_LOAD_XDP-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-bpf$PROG_LOAD-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) bpf$PROG_LOAD(0x5, 0x0, 0x0) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_EVENTS-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000280)={0x0, 0x4}, 0xe) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r4, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$inet6_sctp-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-getpeername$l2tp6-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) getpeername$l2tp6(r0, &(0x7f00000002c0)={0xa, 0x0, 0x0, @mcast2}, 0x0) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r3, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-sendmsg$qrtr-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) sendmsg$qrtr(0xffffffffffffffff, 0x0, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Read in l2tp_tunnel_del_work testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-openat$cgroup_ro-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$BPF_RAW_TRACEPOINT_OPEN-socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, 0x0, 0x0) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program did not crash testing program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp program did not crash simplifying guilty program options testing program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp program did not crash testing program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp detailed listing: executing program 0: r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet_udp(0x2, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000980)=@pppol2tpin6={0x18, 0x1, {0x0, r2, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @local}}}, 0x32) connect$pppl2tp(r0, &(0x7f0000000980)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {0x2, 0x0, @private}, 0x1, 0x2}}, 0x26) program crashed: KASAN: slab-use-after-free Write in l2tp_session_delete extracting C reproducer testing compiled C program (duration=2m30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$pppl2tp-socket$pppl2tp-socket$inet_udp-connect$pppl2tp-connect$pppl2tp program did not crash reproducing took 1h4m7.100883513s repro crashed as (corrupted=false): wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in test_and_set_bit include/asm-generic/bitops/instrumented-atomic.h:71 [inline] BUG: KASAN: slab-use-after-free in l2tp_session_delete+0x28/0x9e0 net/l2tp/l2tp_core.c:1639 Write of size 8 at addr ffff88807bc06008 by task kworker/u8:8/2463 CPU: 1 PID: 2463 Comm: kworker/u8:8 Not tainted 6.10.0-rc5-syzkaller-01097-g748e3bbf4721 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: l2tp l2tp_tunnel_del_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] test_and_set_bit include/asm-generic/bitops/instrumented-atomic.h:71 [inline] l2tp_session_delete+0x28/0x9e0 net/l2tp/l2tp_core.c:1639 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1302 [inline] l2tp_tunnel_del_work+0x1cb/0x330 net/l2tp/l2tp_core.c:1334 process_one_work kernel/workqueue.c:3248 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329 worker_thread+0x86d/0xd50 kernel/workqueue.c:3409 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 5259: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:4123 [inline] __kmalloc_noprof+0x1f9/0x400 mm/slub.c:4136 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] l2tp_session_create+0x3b/0xc20 net/l2tp/l2tp_core.c:1675 pppol2tp_connect+0xca3/0x17a0 net/l2tp/l2tp_ppp.c:782 __sys_connect_file net/socket.c:2049 [inline] __sys_connect+0x2df/0x310 net/socket.c:2066 __do_sys_connect net/socket.c:2076 [inline] __se_sys_connect net/socket.c:2073 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2073 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 24: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2196 [inline] slab_free mm/slub.c:4438 [inline] kfree+0x149/0x360 mm/slub.c:4559 __sk_destruct+0x58/0x5f0 net/core/sock.c:2191 rcu_do_batch kernel/rcu/tree.c:2535 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3072 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176 pppol2tp_release+0x24b/0x350 net/l2tp/l2tp_ppp.c:457 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x406/0x8b0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:180 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88807bc06000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 8 bytes inside of freed 1024-byte region [ffff88807bc06000, ffff88807bc06400) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7bc00 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffefff(slab) raw: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000003 ffffea0001ef0001 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x152820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 57, tgid 57 (kworker/u8:4), ts 183804876495, free_ts 183486584799 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473 prep_new_page mm/page_alloc.c:1481 [inline] get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page+0x5f/0x120 mm/slub.c:2265 allocate_slab+0x5a/0x2f0 mm/slub.c:2428 new_slab mm/slub.c:2481 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667 __slab_alloc+0x58/0xa0 mm/slub.c:3757 __slab_alloc_node mm/slub.c:3810 [inline] slab_alloc_node mm/slub.c:3990 [inline] __do_kmalloc_node mm/slub.c:4122 [inline] __kmalloc_noprof+0x257/0x400 mm/slub.c:4136 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] neigh_alloc net/core/neighbour.c:494 [inline] ___neigh_create+0x691/0x2470 net/core/neighbour.c:648 ip6_finish_output2+0x1631/0x1680 net/ipv6/ip6_output.c:128 ip6_finish_output+0x41e/0x810 net/ipv6/ip6_output.c:222 NF_HOOK include/linux/netfilter.h:314 [inline] ndisc_send_skb+0xab2/0x1380 net/ipv6/ndisc.c:509 ndisc_send_ns+0xcc/0x160 net/ipv6/ndisc.c:667 addrconf_dad_work+0xb45/0x16f0 net/ipv6/addrconf.c:4281 process_one_work kernel/workqueue.c:3248 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329 worker_thread+0x86d/0xd50 kernel/workqueue.c:3409 page last free pid 5198 tgid 5198 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1093 [inline] free_unref_page+0xd22/0xea0 mm/page_alloc.c:2588 discard_slab mm/slub.c:2527 [inline] __put_partials+0xeb/0x130 mm/slub.c:2995 put_cpu_partial+0x17c/0x250 mm/slub.c:3070 __slab_free+0x2ea/0x3d0 mm/slub.c:4308 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9e/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3940 [inline] slab_alloc_node mm/slub.c:4002 [inline] __do_kmalloc_node mm/slub.c:4122 [inline] __kmalloc_noprof+0x1a3/0x400 mm/slub.c:4136 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3761 ip6_route_add+0x28/0x160 net/ipv6/route.c:3853 addrconf_prefix_route+0x314/0x4e0 net/ipv6/addrconf.c:2485 inet6_addr_add+0x627/0xb00 net/ipv6/addrconf.c:3062 inet6_rtm_newaddr+0x8a3/0xc80 net/ipv6/addrconf.c:5047 rtnetlink_rcv_msg+0x89b/0x1180 net/core/rtnetlink.c:6641 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 Memory state around the buggy address: ffff88807bc05f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88807bc05f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88807bc06000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807bc06080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807bc06100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 ================================================================== BUG: KASAN: slab-use-after-free in instrument_atomic_read_write include/linux/instrumented.h:96 [inline] BUG: KASAN: slab-use-after-free in test_and_set_bit include/asm-generic/bitops/instrumented-atomic.h:71 [inline] BUG: KASAN: slab-use-after-free in l2tp_session_delete+0x28/0x9e0 net/l2tp/l2tp_core.c:1639 Write of size 8 at addr ffff88807bc06008 by task kworker/u8:8/2463 CPU: 1 PID: 2463 Comm: kworker/u8:8 Not tainted 6.10.0-rc5-syzkaller-01097-g748e3bbf4721 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 06/07/2024 Workqueue: l2tp l2tp_tunnel_del_work Call Trace: __dump_stack lib/dump_stack.c:88 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:114 print_address_description mm/kasan/report.c:377 [inline] print_report+0x169/0x550 mm/kasan/report.c:488 kasan_report+0x143/0x180 mm/kasan/report.c:601 kasan_check_range+0x282/0x290 mm/kasan/generic.c:189 instrument_atomic_read_write include/linux/instrumented.h:96 [inline] test_and_set_bit include/asm-generic/bitops/instrumented-atomic.h:71 [inline] l2tp_session_delete+0x28/0x9e0 net/l2tp/l2tp_core.c:1639 l2tp_tunnel_closeall net/l2tp/l2tp_core.c:1302 [inline] l2tp_tunnel_del_work+0x1cb/0x330 net/l2tp/l2tp_core.c:1334 process_one_work kernel/workqueue.c:3248 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329 worker_thread+0x86d/0xd50 kernel/workqueue.c:3409 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 5259: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:370 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:387 kasan_kmalloc include/linux/kasan.h:211 [inline] __do_kmalloc_node mm/slub.c:4123 [inline] __kmalloc_noprof+0x1f9/0x400 mm/slub.c:4136 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] l2tp_session_create+0x3b/0xc20 net/l2tp/l2tp_core.c:1675 pppol2tp_connect+0xca3/0x17a0 net/l2tp/l2tp_ppp.c:782 __sys_connect_file net/socket.c:2049 [inline] __sys_connect+0x2df/0x310 net/socket.c:2066 __do_sys_connect net/socket.c:2076 [inline] __se_sys_connect net/socket.c:2073 [inline] __x64_sys_connect+0x7a/0x90 net/socket.c:2073 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 24: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:579 poison_slab_object+0xe0/0x150 mm/kasan/common.c:240 __kasan_slab_free+0x37/0x60 mm/kasan/common.c:256 kasan_slab_free include/linux/kasan.h:184 [inline] slab_free_hook mm/slub.c:2196 [inline] slab_free mm/slub.c:4438 [inline] kfree+0x149/0x360 mm/slub.c:4559 __sk_destruct+0x58/0x5f0 net/core/sock.c:2191 rcu_do_batch kernel/rcu/tree.c:2535 [inline] rcu_core+0xafd/0x1830 kernel/rcu/tree.c:2809 handle_softirqs+0x2c4/0x970 kernel/softirq.c:554 run_ksoftirqd+0xca/0x130 kernel/softirq.c:928 smpboot_thread_fn+0x544/0xa30 kernel/smpboot.c:164 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:541 __call_rcu_common kernel/rcu/tree.c:3072 [inline] call_rcu+0x167/0xa70 kernel/rcu/tree.c:3176 pppol2tp_release+0x24b/0x350 net/l2tp/l2tp_ppp.c:457 __sock_release net/socket.c:659 [inline] sock_close+0xbc/0x240 net/socket.c:1421 __fput+0x406/0x8b0 fs/file_table.c:422 task_work_run+0x24f/0x310 kernel/task_work.c:180 resume_user_mode_work include/linux/resume_user_mode.h:50 [inline] exit_to_user_mode_loop kernel/entry/common.c:114 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:328 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0x168/0x370 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f The buggy address belongs to the object at ffff88807bc06000 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 8 bytes inside of freed 1024-byte region [ffff88807bc06000, ffff88807bc06400) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x7bc00 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: 0xffffefff(slab) raw: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 raw: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000040 ffff888015041dc0 dead000000000122 0000000000000000 head: 0000000000000000 0000000000100010 00000001ffffefff 0000000000000000 head: 00fff00000000003 ffffea0001ef0001 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0x152820(GFP_ATOMIC|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_HARDWALL), pid 57, tgid 57 (kworker/u8:4), ts 183804876495, free_ts 183486584799 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1473 prep_new_page mm/page_alloc.c:1481 [inline] get_page_from_freelist+0x2e4c/0x2f10 mm/page_alloc.c:3425 __alloc_pages_noprof+0x256/0x6c0 mm/page_alloc.c:4683 __alloc_pages_node_noprof include/linux/gfp.h:269 [inline] alloc_pages_node_noprof include/linux/gfp.h:296 [inline] alloc_slab_page+0x5f/0x120 mm/slub.c:2265 allocate_slab+0x5a/0x2f0 mm/slub.c:2428 new_slab mm/slub.c:2481 [inline] ___slab_alloc+0xcd1/0x14b0 mm/slub.c:3667 __slab_alloc+0x58/0xa0 mm/slub.c:3757 __slab_alloc_node mm/slub.c:3810 [inline] slab_alloc_node mm/slub.c:3990 [inline] __do_kmalloc_node mm/slub.c:4122 [inline] __kmalloc_noprof+0x257/0x400 mm/slub.c:4136 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] neigh_alloc net/core/neighbour.c:494 [inline] ___neigh_create+0x691/0x2470 net/core/neighbour.c:648 ip6_finish_output2+0x1631/0x1680 net/ipv6/ip6_output.c:128 ip6_finish_output+0x41e/0x810 net/ipv6/ip6_output.c:222 NF_HOOK include/linux/netfilter.h:314 [inline] ndisc_send_skb+0xab2/0x1380 net/ipv6/ndisc.c:509 ndisc_send_ns+0xcc/0x160 net/ipv6/ndisc.c:667 addrconf_dad_work+0xb45/0x16f0 net/ipv6/addrconf.c:4281 process_one_work kernel/workqueue.c:3248 [inline] process_scheduled_works+0xa2c/0x1830 kernel/workqueue.c:3329 worker_thread+0x86d/0xd50 kernel/workqueue.c:3409 page last free pid 5198 tgid 5198 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1093 [inline] free_unref_page+0xd22/0xea0 mm/page_alloc.c:2588 discard_slab mm/slub.c:2527 [inline] __put_partials+0xeb/0x130 mm/slub.c:2995 put_cpu_partial+0x17c/0x250 mm/slub.c:3070 __slab_free+0x2ea/0x3d0 mm/slub.c:4308 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9e/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:322 kasan_slab_alloc include/linux/kasan.h:201 [inline] slab_post_alloc_hook mm/slub.c:3940 [inline] slab_alloc_node mm/slub.c:4002 [inline] __do_kmalloc_node mm/slub.c:4122 [inline] __kmalloc_noprof+0x1a3/0x400 mm/slub.c:4136 kmalloc_noprof include/linux/slab.h:664 [inline] kzalloc_noprof include/linux/slab.h:778 [inline] fib6_info_alloc+0x2e/0xf0 net/ipv6/ip6_fib.c:155 ip6_route_info_create+0x445/0x12b0 net/ipv6/route.c:3761 ip6_route_add+0x28/0x160 net/ipv6/route.c:3853 addrconf_prefix_route+0x314/0x4e0 net/ipv6/addrconf.c:2485 inet6_addr_add+0x627/0xb00 net/ipv6/addrconf.c:3062 inet6_rtm_newaddr+0x8a3/0xc80 net/ipv6/addrconf.c:5047 rtnetlink_rcv_msg+0x89b/0x1180 net/core/rtnetlink.c:6641 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2550 Memory state around the buggy address: ffff88807bc05f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff88807bc05f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff88807bc06000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff88807bc06080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff88807bc06100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================