Extracting prog: 1h1m48.946067589s Minimizing prog: 2h9m55.004427932s Simplifying prog options: 11m44.78925032s Extracting C: 6m24.855387449s Simplifying C: 0s extracting reproducer from 55 programs testing a last program of every proc single: executing 13 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$unix-socket-bpf$PROG_LOAD-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-bpf$PROG_LOAD-bpf$BPF_PROG_DETACH-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-bpf$PROG_LOAD-bpf$BPF_PROG_DETACH-setsockopt$netlink_NETLINK_TX_RING-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_WOL_SET-listen-socketpair$nbd-getsockopt$sock_buf-syz_emit_ethernet detailed listing: executing program 0: r0 = socket$unix(0x1, 0x2, 0x0) r1 = socket(0x10, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x16, 0xe, &(0x7f00000017c0)=ANY=[@ANYBLOB="b702000000000000bfa30000000000000703000000feffff7a0af0ff1100001f79a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7040000050000006a0af2fe0000000085000000c4000000b700000000000000950000000000000000e154cd844a954b26c933f7ffffffffffffff55bb2007ee51050512b5b42128aa090a79507df719af36349f298129da4871307b534bf901115e17392ac66ad022186a8929d1c000006146001e04aeacea799a22a2fa030000c412f6cae80043eb27d53319d0ad229e5752548300000000dbc2777df150dd488318b5790bee7e6c8bd03acdd77b85b941092314fd085f028f4e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b217369ca8b6712f000000001b1df65b3e1b9bf115646914ce53d13d0ccacda1ef16fdcceaede3faedc51d29a47fc813ce3d32cfc7a53ac271d6d6f4ea6bf97f2f1be2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804d4a69bf9bc5fa77ee293fbd165a5a68488e40b030166565a097b1b44b451de7940b0000db8db03d4b7745fef1d04ec633dee254a6d491b8496da787e814c4fdf0b4a387b4c8149d18c1020029a18986252a70f8f92eb6f0e8c7db000068fbaa2e2a27efd9104297f2c58159f02d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa909ac06b57479321a0574fb304bc2a1681989328c8ddc20ea011bf5742e0ef94234db1f00000000000000c20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b35f421c3552772ca7f3e2c25a65f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41aad8bda74d66f47cc17d8ba3eec0fd80f82c5f573c6d294d366505000000da0fde0745db06753a7ac7fe13cab6692422a46e9ffe2d4a2d32f7528751313694bf5700b20ef0c248ddd3da323947004cacadcaff2066bb5d4045c9585638c2153a6eee01738b0c10671f4f559b7dcb98a6273b8c5f1e24d9f679e4fbe948dfb4cc4a389469608241730459f012b060e7d23fd39206000000000000eb55d001623258a141bd587cc9dad46de56ef907b059b99a79ae5498f6589880ed6eea7b9c670012f80cd6a1397953ba5870786554df26236ebced9390cb6941b8365d936a7d2120eca291963eb2d537d87cbb54e588ee5d6944ee4de5c183c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a0aa9a104e16b3b8c6e64836ac3f32f53c9a2bae513464ca03aff14b9fd8cd9539f5096412b92012e095b84c202060098df3314f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c363000000000223201780200c6ed7966130b547dbf8b497af0a77f52f2cd39000000200000e81c23cf14156951210001c800000000001500000000000928ee53595a779d243a48cea769470424d28804c026ab7f4a5c81921e0128dfd70b438af60b060000000000000056642b49b745f3bf2c01808b6d7d748308eea09f0161b4735efbf3411738d6ee7aebf9ef40662d7836d252c566e1ee938a9a6804ed3a1079b0282a12043408cd60b9e53978c81839be0000000000456f7d2a42cb13da2022f23eaec61854f640f701db0276652f6c74f20675eb781925441578e93046aaddea394cd8ffd3d628293e591dc6f71c2710a7ea8a4fdc214e1cc275b26adfa892e6de9200000000e50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab50fe82d5a96b09c68c73de2f04f15d005387577f480000ea65559eb00e014df20fa209bcbb5c252b11a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cdfba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2f085185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bbf96c89739f5d81e750d50515a59a3ad09e8802e8f4f535447dc0fc9d5f99a145dfcedad69da9cd4b75c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d583f436137a3c5dc714c9402c21d181aae59efb28d4f91652f6750b9195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa80900000000b6638c420eb4304f66e3a37aaf000000c42a570f0e9d76fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284df80e4636c25b96174327d82761c26e329555f9290af40000000000000100000fd3763655500344bae34347f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419a5c16e2055b85058099448430587a49bed2ee9647c5d3bbb47bc00edf5e9020c09ab004321610b857e8717974b633b21cb32f0e03280e09758bd445ab91d201782d656ab09f508bbbaca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92b32af00f191b66b6a6f732a91f0a2e9120be61e58c79d497247d278888901d44bf77e8246605a644e9e3d769db497c3960df05caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f3101985602688888ccb85c87b4f8ffffff7f000000002c331fca0e541b7ca2119ff0d61c5224550346115b43f8b1894c8fa8a14dc4810f61ae01000000000000000000000102000000000000000000000027c9585c0cead5d619d18475ccde2857279a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77a23b0000e49666c464d35ca9b50f3ed3e535b3da8c17a23692759ccf5a205311b7d122532697b861dfb54609fd88e6043bd52ae84c1bb0c8a6c769f952b3d42c68a3102fa1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e8918a0d6e2949affcacb5ba0a56aa063b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76b0d3958f7f05b47d3e519f1634e8fbd8d31330d89069f9448a2ff93060ff073b3a113e47edf76f7d1b8b90bc0df4cfb0b9c8c80158b44ecae9420654f7016b0aac117087406d343e27b372d6027ab2aec2bcad7fe6bb932bc5751d2974e95455a277fa3b472bc7bbdd2ac5a1ea608e8137ace03361607cc1a84be659355629ab13ad49008c3fcfa2423439a3607961d5b59da48a0155e8e42cc13c702cc40c99cf86c2021d72f9f4ab1b00de555a5a39593c93871ff7eb5ecadb64837a2d88723ef65aa5152e3d5864e57581b61f2b0960600000000000000265f091e7bce17d20604c5ab751773a5cf8a719a7ada06ed03832bf274707c7c970edc20f4a1eaa3b610450d2025cae6d2cb639ecd58709b05a20097208d03f7a146a6901913618738679d4e0af53eae997eecfa0dc3dcec19d3d9205450765d659220c92701ee75c8710470d9eb6f62c5c721883f1544ba66271c8dab05a933746c16b6e93294b561c6715a32a394ed1e6c01670c931bfa52c58c6f34d64e758a7a7f7d33c49336d4cba2cbb170ad7539a45774dfcc55257215c8ae719dc1c232fc6699ef01005887d04a543030b4328ab48744ac23ff56fd2da52eb9fb2eefcdd2d92d73ac1b111ea8b5e1fec36a3579879acfe366d393f1fa9cbe08d9ba57a443643e9cd251dc88e91a5e458e66ea1e822d55d4dd919a95eb4c25a08cb6e1070000003a0fd07a4ad9df240e00006aaa2db0dfe416146840d88bd08365e547c970e2983200703864a3b9e1682cb479dad6d34d211b05267eb1355520e9ec0c5014b0832f7fb35782fdbfcbf5e23a7f5d51ea480371748d18d8e10608ab8261fe058d1732f28814a9981d84a04a2bb36c89bdd245e3293a14df1ac567301a79514f103abd387d6ef2d9d94508ac0f6135c8921279573eefd5d4e33b9ef585980789a94d9848906f545559d30000b5040f0776703363249ca984cbb09752f099efbb9e7362e4999594c1086d8958e9469db01d85fb0b9b3148663e9ea2e755d96c70e540b4200e4cf82986712dd733b26d00e947d03c42215118426d548cb2077b43b89e4163d260faea1db53e2cf3427c90aefa2662a1c2b28b0e020e872bda1d39da508de5dbc37d03ee056b2579a1d16799589a2600000000aa00006c94bcaf115fbbcb216e3cb7fd9afe16d1fff2d047e508aa5f6de0ea4e9ec1b3a4ab1f8b5f312fc50000000000000000000000000042709db6de7e969ac0ce18b47280fb1b1b1531648122fed3e25edecb5200f5000000000000166f7d36b2966c19af7ffa6afa69e50821c9aa3ae60fbc196cf8ad2f7f86d79db1bb0ecbf9c3d0d3d407574def838e4def26ed9c7e6c69858f7813be8ffc565583663bebfe7485660b67e1436cbc6d4d3c48ab7b033d7d1195173edb16643f69cb779802839d490a4df94e5ea89c192af2ae83876edd59c9a7140e12ba591f073ec604f7e8f1e100cd414e9237ecfc052d9a73a868cd0e4b06da0435af72fb0d25657e8f5464b19fa83f977e6900000000367871fa37420e7a232ef9b440bb0639994c655d144c5786939d6a187b8182ddd2bec36cd28371b1754cb6c53697fb23576ee0d3fd0a5803c9be9fe384f1a7a9a8eb64d17d238fa3238a001aa8ed040a69e9ec0a627e3b3ca64d4680d819c14c71684581000000000000000000000000000000000000c6a6587715865fe14558960bc936bc83abd1f2a00b17a407457681d0760000000000000040000000000000000000004faeabea6de40ae30291662594c993099ef041c264a64d77d69e0cdfa620a191704cef91e269044acf752b55690075fa844de65a099200265e13c2a8f9b717886dea8e79407e34bc268a17965033ca1d000000000000000046595642f9fc008875ddb7aebda7a16b1d20dd8b65bcdac8cdc75a173fd2e57a9c37bf5a52ea001ec981dd7ad4e5944575ced39233ada8f3c1b856644812828bb79536a5188d14fe537250dc107121534cbbc7598f48aa2335616ae8eb72acf6982048e568e37f1f58e9714343587734c7ec0fa5c44d13165d6384bf9500757b4b0275950d6e7c451eef3fd353d47c54c4c2cf7318e6c24583ba0966225284d1abac80786519c563ddf0e6c023d537ca6e0d6d4e072c98f45415d13f0dcea174f162ebd00b42264f6fa3dccd09f4101dd254e54423b30e06713eccfacb6ffb38afff920980af938a4d78f4b9a6b5c7424e91121cda789104ee490d25843f1622bba93257cc23e45cd7ed42abdb991d51804e674e507dfd53b5ab6944df33f4f494b9ae0d2de410539828e82a939ad82b385e66809d7d4d3630b6f22c2f41fdaa0fadeea09fa4f7005813643c2d6307d55689faf6f656327ac5872a3bd4c11363909a8b9f30e5401993a0f6e1a9b42287542647d1e86b02b7e36319414629ac1f35572a9cc1e98ce1457f922da0c2de76c9e97944efad0a3ad78cda81c5b82709d696e85bbf4595ef9664a6aff8cf96446cb6c26595f4eb659d26c846471f6551dbb24fc6c03a01e33efcd5939472b687d31be9bd9bd1bcda45bd2236f06c000000007d348ebcb9d810d4dc3c55bbe4055ce9c45267daeec7a7d8b498f56ee933cc02fb53c2c28fa09ce5ada5687889357599971a8c794f8ce23c1f7add4f65280ab446ea2d130000000000000000000000d1a0313ff63bc4e4463688db1d6ac7f4595a02c89349a973f118d936f33ea18e69d7739f4532e1b8580ef125b47cf5b402b6f2beffed6cc9afe2b548c4dbc78363118818d9473f29d52444685c41620eeaeb1f8786e87aeaf287fb9b63b30e6761507503dcd47b64f0b6157d970a989844f9b7dbe83211cd7999c82bd151bee0c67f3e6642ef1772d759df9ec9b4197383f9a66217e180e434e650dd560aa3ed42acddd44d6f45807a3c63e15929cfbebc7eef1a219d3147a6c06bd974168ac689392fa851ebdf524ca2331148ff7e855cccc106074ca92153734d5c5e3f9efc6592b08e0c07c7b5d42ec71484bb2a4c0f4293138369f39f9fa4a9cc607b42ba6102f918ce4e76d66fba450e94849962fae5059bda419fd2a170ea387c10a4ada5893f38486069ef1bfdbb432ab322ce87d7a94fa967135833157bafbed3b48bb267fc3aa56d1e5b66417a673b40884fc91ec9558eab6a08222dfe37767095b2d94cda881290d6017137595cdd53972353f485adfde8015cac0e1acd64ca97d67023f75a54b1ebe55053652ad16292a15e79dc58ba080f795f1a753d1c5c85475e286c548da6f669e5c34afc272e5a32f27264d9210acec3b65a264fd5e85d5f44979431eab3fcd8d33d5476e070d2e20e6156ad9c964ebbfe7d9096461b72530295b3603bf85b0c8f9921e9ca95d744bf5c03d60f7364f3fd9d98f7acc80cabd02d061818d028056c68805ee4783aa4b90d39e9b29085429de28c615668e4b4f4dd77b3a55a8058b99f3adff03294e01da549dd64cacd59382466e562a3f67ef5d042426659574ed041bc19ed625b7c0633154a290f69437f43065795d3ae5b11ee8e935b9969f5291a32ce3adca268162efcee3898e823affe0f50f7efe763d47288004a2b310e2a79115160b8e0e09067f26a7653a3a0886691fe44a307f8f344eb9512b632bc132c26220ec86dbf788f4fadd493c37e38f782fc1c0e64f7d3e6a04aa1918796fa53353ab58cfc4505147ed35624871b085e507c90b991a675bf2b6393a732f4a69c3859dbeca89140ba5b3f47d457877d327fa9b936"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffff1e, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)={@cgroup=r2, r3, 0x2, 0x2, 0x0, @void, @value}, 0x10) bpf$BPF_TASK_FD_QUERY(0x14, 0x0, 0x0) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x9, 0x4, &(0x7f00000008c0)=ANY=[@ANYBLOB="180000000000000000000000000000006112000000000000950000000000000051fa7824c74186dc02ec0696c37b64e3b24da3180100000005165c0f63cdc2e82818254950ee03568b8809a1ff4c7c4750eabfafcb9531b31e6a86827d1010c5a909ab98e00e19644a88e95ba26d1c9eecddb2d11c541418ceeb29b9b6829c6e433822bdb3cc85244aab60c1aae1314d7381fcfeb970bea672cf1e926f6a51479343144648a07a975bd89dc398712376610f6254f12495b4658319684387f6f3543205d4bc4ce05b8b961103673dff7f158052e62b20f05fd24108d8363d44fcd0f8f3647899762a17282a1914452d11f557c28f396eebdc858558db0276d14f9035f2b5f703e5be7e4acf8b78c2834ae5805fffee38a9a0033d520bcf6b08ede50899d4b9bdf85c71c5de2503dab358f42a2624c7daa9ed44039aab46419496362e54cfad05a0004ac71a003d7b85d07191bed4e5a890826300214146f7ed569985439baa355c2766dd056f5d79e454f3d873095e7a237bc06d035a8d601f21746d886419f38b34a495040000000071c2f0cce8c93cc17e9afa314fcb2ba15d646c66b0f65021829f87d988b4e2d71753b1549fa734f0b2e56dbd21ed2e09d0cddad721971637f384eed3034597c93e1c52f42cad0ed09c395dc6e9703660fefa1c80f467367c006f25caf0cbcefd13d68839893e39c588eb032905f91cafa4996dbf0c9be9654db05fb918086cc8228d02a3092c0830b8f587a5624515298b2d4eb2bde6f9a2eb83d53f717f13fa7552d92c51dbd32ea50c490ecd085d2811a7555c538cffffff7f00000000dd872244bfa64779e0f43a9c277e2910b7ccdc3d6726d34ad2101033a623ca2a49ad344884289130bc71cee2b7de62bf48129ae1af052a2d46a61625735a9eea7f793946b3229e861d8ea49806b3f7d4295f6b000000000000f337b1ceb2d8a65dcdcd895d7ba37098d2593fdaaef445af5bee02019c00000099b13ecda2a5b37de0519e974cba92ebaf0f701611a9b027ce04340bda4594cc9049c3f101629ab028145e004209ebe71a6fe84af50804000000000000004a27213354964e250a98fe357676f94b6947383e320fbb1118f586d5b9b1b977e1e1a4490ff67703a9b5900f8a6f8a805879dd91ec5ff435b219c53680c0ae04dcc4ef69b98fcb0d6b6a03a8b71a66b4e2876dc4b610444bf10000000000b046b6ae5d68156bcbd6d8793ade9a22ac8fc7857e5bbc14adc4e12b08f350c6789283b9990c72e64372a1f79769a8bdc632fc1a0b3417855d8b7d25ca4d404c23631ad3d2f55dcd385371c86170a4bca58c2b2b4eabc365f45bd10bb45b0c5bc354456a52be18d9b44014d20a3c51c8f013dade83562e73278662829e4f5a9ac00fd91178468c737f0872d97d38d11a176be5a0d7294c51eb161eddcfefa8837c7430721851ec2a107af0df6d43e732bbc01e76c66895eb85d36798d61622773591ee21ad9f6a1b73fa9cf3ffeb8a00b63af800a81d0fb8aa29df8b8ad6fbafefb5802a23cbdeeabceda5bfc5ff2fa5c1d61d04a1324794c6ed000696d9f04010c35474e690545c3d9bd836d4cef2585ba616e01c3d000000000000000000470ebc6f3453ecbf3047e4547d7632d3ad21798e730cb5d1da059b5bdb8107815dff995c0788906790406dfb4f8ee9f24ff94233e2e6e581e6e5de33a5f254c9a8b612547473c3001df3928dac9203b744619082421a8da7c00000000000000000000000000000018a73ef40cca690fb7595c6962984f8276677be6f66cbdbccf1896433808c9c84d74ac4a7c186a04a2250972f7acb156b21f9826b6acb7db32c4e3b3ec8b59fd972975edb1da872d81a35e4fda2f5cbde6b40bea20418c6e9dad30b791eea58f53e80fee4dd7fe08373ea2784fcd3a65261de71eb866458d2c22a"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sock, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000040)={@cgroup=r4, r5, 0x2, 0x0, 0x0, @void, @value}, 0x10) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x6}, 0x10) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_WOL_SET(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000880)={0x1c, r6, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_WOL_MODES={0x4}, @ETHTOOL_A_WOL_SOPASS={0x4}]}, 0x1c}}, 0x0) listen(r0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) getsockopt$sock_buf(r7, 0x1, 0x4d, &(0x7f00000014c0)=""/145, &(0x7f0000000080)=0x91) syz_emit_ethernet(0x46, &(0x7f0000000000)={@local, @random="7f0a00035211", @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x38, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @time_exceeded={0x3, 0x0, 0x0, 0x12, 0x0, 0x2802, {0x5, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2f, 0x0, @loopback, @private}, "240088beffff0000"}}}}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_DELOBJ={0x20, 0x14, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0xd}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x48}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_EXP_NEW detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_NEW(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000a40)=ANY=[@ANYBLOB="c80000000002010400000000000000000a0000003c0001800c00028005000100010000002c00018014000300fc00000000000021000000000000000014000400fe8800000000000000000000000000013c0003800c00028005000100000000002c00018014000300fc00000000000000000000000000000014000400000000000000000000000000000000013c0002800c00028005000100000000002c00018014000300fe8000000000000000000000000000bb140004"], 0xc8}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETOFFLOAD-ioctl$TUNSETOWNER-socket$kcm-openat$cgroup_ro-mmap-bpf$ITER_CREATE-sendmsg$nl_route detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000080)={'\x00', 0x52d35ce30131f272}) ioctl$TUNSETOFFLOAD(r1, 0x400454c9, 0x9) ioctl$TUNSETOWNER(r1, 0x400454cc, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.current\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r3, 0x0) bpf$ITER_CREATE(0x21, &(0x7f0000000000)={r3}, 0x8) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="380000005500e50100000000ac8add8607000000", @ANYRES32=r2, @ANYRES32=r2, @ANYRES32, @ANYBLOB="01000000ff"], 0x38}}, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bpf$PROG_LOAD-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-bpf$ITER_CREATE-close-bpf$BPF_TASK_FD_QUERY-socket$inet_tcp-ioctl$sock_inet_SIOCDARP-openat$cgroup_root-bpf$BPF_GET_PROG_INFO-socket$nl_route-sendmsg$nl_route-bind$bt_hci-write detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x6, &(0x7f00000006c0)=ANY=[@ANYBLOB="b40800000000000073114100000000008510000002000000b7000000000000009500c2000000000095000012000000000e09b9445761db3ed82f7be4b9f1628b9a5c40384cb45e62e827e611f21a01a76f66f616553959b478ad3c46bb20e558783b21dd5307760617deec8b1b75c00853ee69e33ba2c01c28950365dd46fcc9f2ac6d20197fd68292e8445824f49b6fba41a316e13e462e31ca00d2622d56318d78e271d364329e7ae732bf8dade587bb30d67e23f78662621b74aabfd8eaf399893bab50fed33101f5a1085f991877907bd6117db675155932860499977f7384a8d94e810492c284fc7cc784ed942bf11d72897a7896f5f8c957984312e9d39eaa478a3065afd52404cb058b"], &(0x7f0000000080)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x70) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x18, 0x3, &(0x7f0000000d00)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000000)='GPL\x00', 0x1, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff, @void, @value}, 0x94) r3 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='ext4_writepages_result\x00', r2}, 0x10) r4 = bpf$ITER_CREATE(0xb, &(0x7f0000000100)={r3}, 0x8) close(r4) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r5 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCDARP(r5, 0x8954, &(0x7f0000000380)={{0x2, 0x0, @multicast1}, {0x0, @link_local}, 0x0, {0x2, 0x0, @broadcast}}) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) bpf$BPF_GET_PROG_INFO(0x1c, &(0x7f00000003c0)={r1, 0x0, 0x0}, 0x10) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=@newlink={0x20, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4048b, 0x40000}}, 0x20}}, 0x88890) bind$bt_hci(r0, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="2d000000010001", 0x7) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_emit_ethernet-syz_init_net_socket$bt_hci-bind$bt_hci-bpf$BPF_BTF_LOAD-bpf$MAP_CREATE-socket$nl_generic-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_NEW-syz_init_net_socket$nl_generic-sendmsg$NFC_CMD_GET_TARGET-syz_genetlink_get_family_id$nfc-syz_genetlink_get_family_id$nl802154-sendmsg$NL802154_CMD_NEW_INTERFACE-ioctl$SIOCX25SFACILITIES-write$bt_hci-setsockopt$IP6T_SO_SET_REPLACE detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x82, &(0x7f00000005c0)={@broadcast, @random="000000000400", @val={@val={0x88a8, 0x3, 0x1, 0x4}}, {@ipv4={0x800, @tipc={{0x13, 0x4, 0x3, 0x3, 0x6c, 0x64, 0x0, 0x5, 0x6, 0x0, @empty, @remote, {[@ra={0x94, 0x4, 0x400}, @noop, @ra={0x94, 0x4}, @lsrr={0x83, 0x13, 0x81, [@loopback, @remote, @broadcast, @dev={0xac, 0x14, 0x14, 0x27}]}, @rr={0x7, 0x1b, 0xb3, [@private=0xa010101, @remote, @rand_addr=0x64010102, @private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010101]}]}}, @payload_direct={{{{0x20, 0x0, 0x0, 0x1, 0x0, 0x8, 0x1, 0x2, 0x0, 0x0, 0x2, 0x8, 0x4, 0x3, 0x8000, 0x4936, 0x0, 0x4e23, 0x4e21}, 0x3, 0x3}}}}}}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000404000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x8, 0x4, 0x4, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x2, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x44, r4, 0x207, 0x0, 0x0, {0x4b}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x44}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r5) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r5) sendmsg$NL802154_CMD_NEW_INTERFACE(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r6, 0x87, 0x70bd2d, 0x0, {0x1e}}, 0x14}, 0x1, 0x0, 0x0, 0x4040025}, 0x4024044) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x42, 0x800000, 0x8, 0x7, 0x0, 0x81}) write$bt_hci(r1, &(0x7f0000000080)=ANY=[], 0x6) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x368, 0x168, 0x6c, 0x0, 0x0, 0x0, 0x298, 0x258, 0x258, 0x298, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [], 'wlan1\x00', '\x00', {}, {}, 0x11}, 0x0, 0x100, 0x168, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x0, 0x0, 0x7}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}, {{@ipv6={@private0, @empty, [], [], 'lo\x00', 'erspan0\x00'}, 0x0, 0xf8, 0x130, 0x0, {}, [@common=@hl={{0x28}}, @inet=@rpfilter={{0x28}}]}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x2001}}, {0x28}}}}, 0xff9e) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_tcp-syz_emit_ethernet-syz_init_net_socket$bt_hci-bind$bt_hci-bpf$BPF_BTF_LOAD-bpf$MAP_CREATE-socket$nl_generic-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_NEW-syz_init_net_socket$nl_generic-sendmsg$NFC_CMD_GET_TARGET-syz_genetlink_get_family_id$nfc-syz_genetlink_get_family_id$nl802154-sendmsg$NL802154_CMD_NEW_INTERFACE-ioctl$SIOCX25SFACILITIES-write$bt_hci-setsockopt$IP6T_SO_SET_REPLACE detailed listing: executing program 0: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_emit_ethernet(0x82, &(0x7f00000005c0)={@broadcast, @random="000000000400", @val={@val={0x88a8, 0x3, 0x1, 0x4}}, {@ipv4={0x800, @tipc={{0x13, 0x4, 0x3, 0x3, 0x6c, 0x64, 0x0, 0x5, 0x6, 0x0, @empty, @remote, {[@ra={0x94, 0x4, 0x400}, @noop, @ra={0x94, 0x4}, @lsrr={0x83, 0x13, 0x81, [@loopback, @remote, @broadcast, @dev={0xac, 0x14, 0x14, 0x27}]}, @rr={0x7, 0x1b, 0xb3, [@private=0xa010101, @remote, @rand_addr=0x64010102, @private=0xa010100, @initdev={0xac, 0x1e, 0x0, 0x0}, @private=0xa010101]}]}}, @payload_direct={{{{0x20, 0x0, 0x0, 0x1, 0x0, 0x8, 0x1, 0x2, 0x0, 0x0, 0x2, 0x8, 0x4, 0x3, 0x8000, 0x4936, 0x0, 0x4e23, 0x4e21}, 0x3, 0x3}}}}}}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000404000000002e"], 0x0, 0x37, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x8, 0x4, 0x4, 0x7, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, r2, 0x2, 0x1, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)={0x44, r4, 0x207, 0x0, 0x0, {0x4b}, [@DEVLINK_ATTR_RATE_NODE_NAME={0xf, 0xa8, @name2}, @handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x44}}, 0x0) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFC_CMD_GET_TARGET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x14, 0x0, 0x4}, 0x14}}, 0x0) syz_genetlink_get_family_id$nfc(&(0x7f0000000140), r5) r6 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000300), r5) sendmsg$NL802154_CMD_NEW_INTERFACE(r5, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000340)={0x14, r6, 0x87, 0x70bd2d, 0x0, {0x1e}}, 0x14}, 0x1, 0x0, 0x0, 0x4040025}, 0x4024044) ioctl$SIOCX25SFACILITIES(0xffffffffffffffff, 0x89e3, &(0x7f0000000080)={0x42, 0x800000, 0x8, 0x7, 0x0, 0x81}) write$bt_hci(r1, &(0x7f0000000080)=ANY=[], 0x6) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000700)=@raw={'raw\x00', 0x3c1, 0x3, 0x368, 0x168, 0x6c, 0x0, 0x0, 0x0, 0x298, 0x258, 0x258, 0x298, 0x258, 0x3, 0x0, {[{{@ipv6={@rand_addr=' \x01\x00', @private0, [], [], 'wlan1\x00', '\x00', {}, {}, 0x11}, 0x0, 0x100, 0x168, 0x0, {}, [@common=@inet=@l2tp={{0x30}, {0x0, 0x0, 0x0, 0x0, 0x7}}, @inet=@rpfilter={{0x28}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz0\x00'}}}, {{@ipv6={@private0, @empty, [], [], 'lo\x00', 'erspan0\x00'}, 0x0, 0xf8, 0x130, 0x0, {}, [@common=@hl={{0x28}}, @inet=@rpfilter={{0x28}}]}, @common=@inet=@SET3={0x38}}], {{'\x00', 0x0, 0xa8, 0xd0, 0x0, {0x0, 0x2001}}, {0x28}}}}, 0xff9e) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGPGRP-bpf$BPF_TASK_FD_QUERY-openat$cgroup_root-socket$nl_generic-sendmsg$nl_generic-socket$rds-bind$rds-openat$cgroup_pressure-close-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-writev-socket$inet6_mptcp-socket$packet-setsockopt$packet_fanout-setsockopt$sock_int-setsockopt$packet_fanout_data-syz_emit_ethernet-setsockopt$inet6_tcp_TCP_CONGESTION-bind$inet6-connect$inet6-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$nl_generic-syz_genetlink_get_family_id$devlink-sendmsg$DEVLINK_CMD_RATE_SET-socket$packet-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_l2cap-connect$bt_l2cap detailed listing: executing program 0: ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000100)=0x0) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000080)={r0, 0xffffffffffffffff, 0x0, 0x90, &(0x7f0000000240)='cgRoup\xf7\xd4.\x10\x19\xbfB\xca\xb1\xf3\x10\x9c\xbf\xafz\x96}7\xeb\x87\x89\xd9b\x1c\xb0Z.\xf6\x01L]d\xeb\x17\xa3\x9d\x82\xd1\x1a\x99\xc2m\xaf\xd0\xe8P<\x9d\xff\xa0\b\x00\x00\x00\x00&\x7f\xa0_\t\xe5gF#\x04\\\x01H\xa6\xb8\x9c\x05\xe7\xe4\x06\x14D\xe9t\xe2s*\xe7I\xa1\xd8\xfa\xed~\xf9\x8d\x83P.1\xf3\xa4N$\xc5\xf9J\xa0\xb2\xe5\xbb\x04\xa7<\x10\x1c\xc5\xb2\x85\xd7\xde\xc6\x06\xf6^m\xb1\xa5\xe2h\xf9\xa3d\x06|wI\xcaP\x93\xb5\xb2\xf0'}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)=ANY=[@ANYBLOB="240000002a000bd429efd00475d600000000000000000004000000040003000c00018006e0c1a3590492dd2989c3e2edcb1ce27e1fb0df813eccb228e271f7ebfd300bba8095cbad8c9dcb06c4922b3095a1c81c7df3f4040fd7dfa7fae51e651335b2872dd4e6249c880a4e1348d16293f9bcd2f659c57ad2829decd2b1091405"], 0x24}}, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) bind$rds(r3, &(0x7f0000000080)={0x2, 0x1, @loopback}, 0x10) r4 = openat$cgroup_pressure(r1, &(0x7f00000000c0)='io.pressure\x00', 0x2, 0x0) close(r4) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r6, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) writev(r5, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x1fffa2}], 0x1) r7 = socket$inet6_mptcp(0xa, 0x1, 0x106) r8 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_fanout(r8, 0x107, 0x12, &(0x7f0000000480)={0x0, 0x8007}, 0x0) setsockopt$sock_int(r8, 0x1, 0x2c, &(0x7f0000000040)=0x9b, 0x4) setsockopt$packet_fanout_data(r8, 0x107, 0x16, 0x0, 0x0) syz_emit_ethernet(0x7e, &(0x7f0000001180)=ANY=[@ANYBLOB="ffffffffffff0180c200000086dd6012000800483a00fe8000000000000000000000000000bbfe8000000000000000000000000000aa08029078000000006000081000000000000000000000000000f5feff00000000fc0200000000000000000000000000001100ff206700000032000000000000164301000100000000"], 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f00000000c0)='dctcp\x00', 0x6) bind$inet6(r6, &(0x7f0000000200)={0xa, 0x3, 0x0, @empty, 0x400}, 0x1c) connect$inet6(r6, &(0x7f0000000040)={0xa, 0x3, 0xffffffff, @remote}, 0x1c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0x4, &(0x7f0000000140)=ANY=[@ANYBLOB="18020000000400000000000000090000850000005400000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$devlink(&(0x7f00000004c0), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_SET(r9, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01000000000000008f00300000000e0001006e65744529f93bcecc54d615ed2079d878cd64657673696d0000000f0064657673696d3000000000000000"], 0x34}}, 0x0) r11 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) r12 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r12, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-syz_init_net_socket$bt_hci-socket$igmp6-socket$nl_netfilter-sendmsg$kcm-sendmsg$nl_route-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-syz_genetlink_get_family_id$smc-syz_init_net_socket$nl_rdma-sendmsg$SMC_PNETID_ADD-bind$bt_hci-write-write$bt_hci-mmap-pipe-vmsplice detailed listing: executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=ANY=[@ANYBLOB="280000006a00831300000000000000ffa60000000000000008000e0000000000080005"], 0x28}}, 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$igmp6(0xa, 0x3, 0x2) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)=[{0x0}], 0x1}, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a3000000000090003007379"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_COMPAT={0x44, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x67}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x888e}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x5c}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x800}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_PROTO_IPV4={0x8, 0x1, 0x1, 0x0, 0x89}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x98}}, 0x4040100) r3 = syz_genetlink_get_family_id$smc(&(0x7f0000000000), 0xffffffffffffffff) r4 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$SMC_PNETID_ADD(r4, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)={0x40, r3, 0x1, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'bond0\x00'}, @SMC_PNETID_NAME={0x9, 0x1, 'syz0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz1\x00'}]}, 0x40}}, 0x0) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000040)="09000000010001", 0x7) write$bt_hci(r1, &(0x7f00000000c0)={0x1, @host_buffer_size={{0xc33, 0x7}, {0x6, 0xab, 0x40, 0xc9}}}, 0xb) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0) pipe(&(0x7f0000000140)={0xffffffffffffffff}) vmsplice(r5, &(0x7f0000000040)=[{&(0x7f0000000000)="b9723e1a4ff5e3e4a667a8de9e96d4a493d32d0c67bfefc209447fe7c7f0", 0x1e}], 0x1, 0x4) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-close-connect$unix-openat$cgroup_root-openat$cgroup_ro-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE-connect$bt_l2cap-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD-ioctl$sock_bt_hidp_HIDPCONNDEL detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0) close(r7) connect$unix(r6, &(0x7f0000000140)=@abs, 0x6e) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f00000000c0)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r10) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r10, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c010000", @ANYRES16=r11, @ANYBLOB="000429bd7000fddbdf250a000000080003000800000008000300070000003400018005000200c90000007d5baac6e45e5d01a49508000700", @ANYRES32=r1, @ANYBLOB='\b\x00\a\x00', @ANYRES32=r1, @ANYBLOB="050002000000000008000700", @ANYRES32=r1, @ANYBLOB="08000300ac14142e080004000400000048000680060001000200000014000400ff02000000000000000000000000000108000300e000000208000700", @ANYRES32=r1, @ANYBLOB="0600010002000000050002008900000008000300ac1414bb080002000700000044000180080006000400000014000400fe80000000000000000000000000001c14000400fe8000000000000000000000000000bb08000700", @ANYRES32=r1, @ANYBLOB="08000300ac14143c050005008100000020000680140004000000000000000000000000000000000108000300e0000001"], 0x11c}, 0x1, 0x0, 0x0, 0x40}, 0x4000800) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r12 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r13 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r13, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r12, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) program crashed: INFO: task hung in uevent_show single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-close-connect$unix-openat$cgroup_root-openat$cgroup_ro-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE-connect$bt_l2cap-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0) close(r7) connect$unix(r6, &(0x7f0000000140)=@abs, 0x6e) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f00000000c0)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r10) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r10, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c010000", @ANYRES16=r11, @ANYBLOB="000429bd7000fddbdf250a000000080003000800000008000300070000003400018005000200c90000007d5baac6e45e5d01a49508000700", @ANYRES32=r1, @ANYBLOB='\b\x00\a\x00', @ANYRES32=r1, @ANYBLOB="050002000000000008000700", @ANYRES32=r1, @ANYBLOB="08000300ac14142e080004000400000048000680060001000200000014000400ff02000000000000000000000000000108000300e000000208000700", @ANYRES32=r1, @ANYBLOB="0600010002000000050002008900000008000300ac1414bb080002000700000044000180080006000400000014000400fe80000000000000000000000000001c14000400fe8000000000000000000000000000bb08000700", @ANYRES32=r1, @ANYBLOB="08000300ac14143c050005008100000020000680140004000000000000000000000000000000000108000300e0000001"], 0x11c}, 0x1, 0x0, 0x0, 0x40}, 0x4000800) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r12 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r12, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-close-connect$unix-openat$cgroup_root-openat$cgroup_ro-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE-connect$bt_l2cap-syz_init_net_socket$bt_hidp-syz_init_net_socket$bt_hidp detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0) close(r7) connect$unix(r6, &(0x7f0000000140)=@abs, 0x6e) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f00000000c0)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r10) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r10, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c010000", @ANYRES16=r11, @ANYBLOB="000429bd7000fddbdf250a000000080003000800000008000300070000003400018005000200c90000007d5baac6e45e5d01a49508000700", @ANYRES32=r1, @ANYBLOB='\b\x00\a\x00', @ANYRES32=r1, @ANYBLOB="050002000000000008000700", @ANYRES32=r1, @ANYBLOB="08000300ac14142e080004000400000048000680060001000200000014000400ff02000000000000000000000000000108000300e000000208000700", @ANYRES32=r1, @ANYBLOB="0600010002000000050002008900000008000300ac1414bb080002000700000044000180080006000400000014000400fe80000000000000000000000000001c14000400fe8000000000000000000000000000bb08000700", @ANYRES32=r1, @ANYBLOB="08000300ac14143c050005008100000020000680140004000000000000000000000000000000000108000300e0000001"], 0x11c}, 0x1, 0x0, 0x0, 0x40}, 0x4000800) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-close-connect$unix-openat$cgroup_root-openat$cgroup_ro-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0) close(r7) connect$unix(r6, &(0x7f0000000140)=@abs, 0x6e) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f00000000c0)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r10) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r10, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c010000", @ANYRES16=r11, @ANYBLOB="000429bd7000fddbdf250a000000080003000800000008000300070000003400018005000200c90000007d5baac6e45e5d01a49508000700", @ANYRES32=r1, @ANYBLOB='\b\x00\a\x00', @ANYRES32=r1, @ANYBLOB="050002000000000008000700", @ANYRES32=r1, @ANYBLOB="08000300ac14142e080004000400000048000680060001000200000014000400ff02000000000000000000000000000108000300e000000208000700", @ANYRES32=r1, @ANYBLOB="0600010002000000050002008900000008000300ac1414bb080002000700000044000180080006000400000014000400fe80000000000000000000000000001c14000400fe8000000000000000000000000000bb08000700", @ANYRES32=r1, @ANYBLOB="08000300ac14143c050005008100000020000680140004000000000000000000000000000000000108000300e0000001"], 0x11c}, 0x1, 0x0, 0x0, 0x40}, 0x4000800) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(0xffffffffffffffff, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-close-connect$unix-openat$cgroup_root-openat$cgroup_ro-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0) close(r7) connect$unix(r6, &(0x7f0000000140)=@abs, 0x6e) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f00000000c0)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r10) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r10, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c010000", @ANYRES16=r11, @ANYBLOB="000429bd7000fddbdf250a000000080003000800000008000300070000003400018005000200c90000007d5baac6e45e5d01a49508000700", @ANYRES32=r1, @ANYBLOB='\b\x00\a\x00', @ANYRES32=r1, @ANYBLOB="050002000000000008000700", @ANYRES32=r1, @ANYBLOB="08000300ac14142e080004000400000048000680060001000200000014000400ff02000000000000000000000000000108000300e000000208000700", @ANYRES32=r1, @ANYBLOB="0600010002000000050002008900000008000300ac1414bb080002000700000044000180080006000400000014000400fe80000000000000000000000000001c14000400fe8000000000000000000000000000bb08000700", @ANYRES32=r1, @ANYBLOB="08000300ac14143c050005008100000020000680140004000000000000000000000000000000000108000300e0000001"], 0x11c}, 0x1, 0x0, 0x0, 0x40}, 0x4000800) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r12 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r12, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-close-connect$unix-openat$cgroup_root-openat$cgroup_ro-syz_genetlink_get_family_id$mptcp-sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0) close(r7) connect$unix(r6, &(0x7f0000000140)=@abs, 0x6e) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f00000000c0)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) r11 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r10) sendmsg$MPTCP_PM_CMD_SUBFLOW_CREATE(r10, &(0x7f00000004c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000480)={&(0x7f0000000540)=ANY=[@ANYBLOB="1c010000", @ANYRES16=r11, @ANYBLOB="000429bd7000fddbdf250a000000080003000800000008000300070000003400018005000200c90000007d5baac6e45e5d01a49508000700", @ANYRES32=r1, @ANYBLOB='\b\x00\a\x00', @ANYRES32=r1, @ANYBLOB="050002000000000008000700", @ANYRES32=r1, @ANYBLOB="08000300ac14142e080004000400000048000680060001000200000014000400ff02000000000000000000000000000108000300e000000208000700", @ANYRES32=r1, @ANYBLOB="0600010002000000050002008900000008000300ac1414bb080002000700000044000180080006000400000014000400fe80000000000000000000000000001c14000400fe8000000000000000000000000000bb08000700", @ANYRES32=r1, @ANYBLOB="08000300ac14143c050005008100000020000680140004000000000000000000000000000000000108000300e0000001"], 0x11c}, 0x1, 0x0, 0x0, 0x40}, 0x4000800) r12 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r12, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-close-connect$unix-openat$cgroup_root-openat$cgroup_ro-syz_genetlink_get_family_id$mptcp-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0) close(r7) connect$unix(r6, &(0x7f0000000140)=@abs, 0x6e) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) r10 = openat$cgroup_ro(r9, &(0x7f00000000c0)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) syz_genetlink_get_family_id$mptcp(&(0x7f0000000300), r10) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r11 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r11, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-close-connect$unix-openat$cgroup_root-openat$cgroup_ro-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0) close(r7) connect$unix(r6, &(0x7f0000000140)=@abs, 0x6e) r9 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) openat$cgroup_ro(r9, &(0x7f00000000c0)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r10 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r10, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-close-connect$unix-openat$cgroup_root-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0) close(r7) connect$unix(r6, &(0x7f0000000140)=@abs, 0x6e) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup/syz0\x00', 0x200002, 0x0) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r9 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r9, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-close-connect$unix-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0) close(r7) connect$unix(r6, &(0x7f0000000140)=@abs, 0x6e) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r9 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r9, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-close-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r8 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r8, 0xc004743e, 0x0) close(r7) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r9 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r9, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-ioctl$PPPIOCNEWUNIT-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r7, 0xc004743e, 0x0) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r8 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r8, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-openat$ppp-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-unshare-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) unshare(0x2040400) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-sendmmsg$unix-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) sendmmsg$unix(r6, &(0x7f0000000880), 0x0, 0x40084) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-getsockopt$inet6_IPV6_IPSEC_POLICY-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) getpid() getsockopt$inet6_IPV6_IPSEC_POLICY(r3, 0x29, 0x22, &(0x7f0000000680)={{{@in=@remote, @in6=@empty}}, {{@in6=@remote}, 0x0, @in=@multicast1}}, &(0x7f0000000440)=0xe8) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r6 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-getpid-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) getpid() connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r6 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-socketpair$unix-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r6 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) r5 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r5, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r6 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f0000003900)={r5, r5, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-sendmmsg$inet-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = socket$isdn_base(0x22, 0x3, 0x0) sendmmsg$inet(r4, &(0x7f00000001c0), 0x46, 0x20000800) connect$bt_l2cap(0xffffffffffffffff, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r5, 0x400448c8, &(0x7f0000003900)={0xffffffffffffffff, 0xffffffffffffffff, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-socket$isdn_base-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) socket$isdn_base(0x22, 0x3, 0x0) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r5, 0x400448c8, &(0x7f0000003900)={r4, r4, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-getsockopt$SO_TIMESTAMPING-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) getsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000100), &(0x7f0000000180)=0x4) r4 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r4, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r5, 0x400448c8, &(0x7f0000003900)={r4, r4, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-socket$inet6-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) socket$inet6(0xa, 0x2, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000003900)={r3, r3, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-ioctl$TUNDETACHFILTER-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNDETACHFILTER(r2, 0x401054d6, 0x0) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000003900)={r3, r3, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-ioctl$TUNSETIFF-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) r3 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r3, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r4 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r4, 0x400448c8, &(0x7f0000003900)={r3, r3, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: lost connection to test machine testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-openat$tun-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r2, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000003900)={r2, r2, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-setsockopt$MRT_DEL_VIF-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) setsockopt$MRT_DEL_VIF(r0, 0x0, 0xcb, &(0x7f0000000280)={0x1, 0x4, 0x8, 0x10, @vifc_lcl_ifindex=r1, @empty}, 0x10) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r2, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r3 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r3, 0x400448c8, &(0x7f0000003900)={r2, r2, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) socket$igmp(0x2, 0x3, 0x2) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000240)={'syztnl0\x00', &(0x7f00000001c0)={'ip6tnl0\x00', 0x0, 0x2f, 0x8, 0x6, 0x8, 0x9, @rand_addr=' \x01\x00', @mcast1, 0x80, 0x7, 0x6, 0x7d}}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000003900)={r0, r0, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-socket$igmp-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) socket$igmp(0x2, 0x3, 0x2) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000003900)={r0, r0, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD-syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, &(0x7f0000000500)={0x0, 'veth0_to_bond\x00', {0x4}, 0x4}) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000003900)={r0, r0, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000003900)={r0, r0, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: INFO: task hung in uevent_show testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, 0x0, 0x0) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000003900)={r0, r0, 0x11, 0xffffffa3, &(0x7f00000036c0)="3722c57657", 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, 0x0) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000003900)={r0, r0, 0x11, 0x0, 0x0, 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: KASAN: slab-use-after-free Read in l2cap_unregister_user extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000003900)={r0, r0, 0x11, 0x0, 0x0, 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: KASAN: slab-use-after-free Read in l2cap_unregister_user extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD program did not crash testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD detailed listing: executing program 0: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r1 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r1, 0x400448c8, &(0x7f0000003900)={r0, r0, 0x11, 0x0, 0x0, 0xf, 0x0, 0x7fff, 0x8, 0x2, 0x1, 0x10000000, 'syz0\x00'}) program crashed: KASAN: slab-use-after-free Read in l2cap_unregister_user extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_l2cap-connect$bt_l2cap-syz_init_net_socket$bt_hidp-ioctl$sock_bt_hidp_HIDPCONNADD program crashed: no output from test machine a never seen crash title: no output from test machine, ignore reproducing took 3h30m24.796223766s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:172 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:667 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x7fb/0xee0 kernel/locking/mutex.c:735 Read of size 8 at addr ffff8880122a4060 by task khidpd_7fff0008/6010 CPU: 0 UID: 0 PID: 6010 Comm: khidpd_7fff0008 Not tainted 6.13.0-rc3-syzkaller-00154-g30b981796b94 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __mutex_waiter_is_first kernel/locking/mutex.c:172 [inline] __mutex_lock_common kernel/locking/mutex.c:667 [inline] __mutex_lock+0x7fb/0xee0 kernel/locking/mutex.c:735 l2cap_unregister_user+0x6a/0x1c0 net/bluetooth/l2cap_core.c:1726 hidp_session_thread+0x450/0x490 net/bluetooth/hidp/core.c:1304 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 5924: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4298 [inline] __kmalloc_noprof+0x285/0x4c0 mm/slub.c:4310 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] hci_alloc_dev_priv+0x27/0x2030 net/bluetooth/hci_core.c:2439 hci_alloc_dev include/net/bluetooth/hci_core.h:1693 [inline] __vhci_create_device drivers/bluetooth/hci_vhci.c:399 [inline] vhci_create_device+0x116/0x6a0 drivers/bluetooth/hci_vhci.c:470 vhci_get_user drivers/bluetooth/hci_vhci.c:527 [inline] vhci_write+0x3cf/0x490 drivers/bluetooth/hci_vhci.c:607 new_sync_write fs/read_write.c:586 [inline] vfs_write+0xaeb/0xd30 fs/read_write.c:679 ksys_write+0x18f/0x2b0 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5924: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 hci_release_dev+0x1525/0x16b0 net/bluetooth/hci_core.c:2758 bt_host_release+0x83/0x90 net/bluetooth/hci_sysfs.c:87 device_release+0x99/0x1c0 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x22f/0x480 lib/kobject.c:737 vhci_release+0x88/0xd0 drivers/bluetooth/hci_vhci.c:665 __fput+0x23c/0xa50 fs/file_table.c:450 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:938 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 get_signal+0x16b2/0x1750 kernel/signal.c:3017 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 insert_work+0x3e/0x330 kernel/workqueue.c:2183 __queue_work+0xb66/0xf50 kernel/workqueue.c:2343 queue_work_on+0x1c2/0x380 kernel/workqueue.c:2390 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Second to last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 insert_work+0x3e/0x330 kernel/workqueue.c:2183 __queue_work+0xc8b/0xf50 kernel/workqueue.c:2339 call_timer_fn+0x187/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1839 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x695/0x8e0 kernel/time/timer.c:2430 run_timer_base kernel/time/timer.c:2439 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 The buggy address belongs to the object at ffff8880122a4000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 96 bytes inside of freed 8192-byte region [ffff8880122a4000, ffff8880122a6000) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122a0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801ac42280 ffffea00009e0e00 0000000000000004 raw: 0000000000000000 0000000000020002 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801ac42280 ffffea00009e0e00 0000000000000004 head: 0000000000000000 0000000000020002 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea000048a801 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5499, tgid 5499 (dhcpcd), ts 37935092058, free_ts 37934986027 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3474 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2269 alloc_slab_page+0x6a/0x110 mm/slub.c:2423 allocate_slab+0x5a/0x2b0 mm/slub.c:2589 new_slab mm/slub.c:2642 [inline] ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830 __slab_alloc+0x58/0xa0 mm/slub.c:3920 __slab_alloc_node mm/slub.c:3995 [inline] slab_alloc_node mm/slub.c:4156 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_node_track_caller_noprof+0x2e9/0x4c0 mm/slub.c:4317 kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:609 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1323 [inline] netlink_dump+0x1ee/0xe10 net/netlink/af_netlink.c:2283 __netlink_dump_start+0x5a2/0x790 net/netlink/af_netlink.c:2432 netlink_dump_start include/linux/netlink.h:340 [inline] rtnetlink_dump_start net/core/rtnetlink.c:6820 [inline] rtnetlink_rcv_msg+0xb3d/0xcf0 net/core/rtnetlink.c:6887 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2542 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347 page last free pid 5499 tgid 5499 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0xd3f/0x1010 mm/page_alloc.c:2657 discard_slab mm/slub.c:2688 [inline] __put_partials+0x160/0x1c0 mm/slub.c:3157 put_cpu_partial+0x17c/0x250 mm/slub.c:3232 __slab_free+0x290/0x380 mm/slub.c:4483 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4119 [inline] slab_alloc_node mm/slub.c:4168 [inline] kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4220 __alloc_skb+0x1c3/0x440 net/core/skbuff.c:668 netlink_sendmsg+0x638/0xcb0 net/netlink/af_netlink.c:1866 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 __sys_sendto+0x363/0x4c0 net/socket.c:2197 __do_sys_sendto net/socket.c:2204 [inline] __se_sys_sendto net/socket.c:2200 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2200 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff8880122a3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880122a3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880122a4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880122a4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880122a4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ================================================================== final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: slab-use-after-free in __mutex_waiter_is_first kernel/locking/mutex.c:172 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock_common kernel/locking/mutex.c:667 [inline] BUG: KASAN: slab-use-after-free in __mutex_lock+0x7fb/0xee0 kernel/locking/mutex.c:735 Read of size 8 at addr ffff8880122a4060 by task khidpd_7fff0008/6010 CPU: 0 UID: 0 PID: 6010 Comm: khidpd_7fff0008 Not tainted 6.13.0-rc3-syzkaller-00154-g30b981796b94 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0x169/0x550 mm/kasan/report.c:489 kasan_report+0x143/0x180 mm/kasan/report.c:602 __mutex_waiter_is_first kernel/locking/mutex.c:172 [inline] __mutex_lock_common kernel/locking/mutex.c:667 [inline] __mutex_lock+0x7fb/0xee0 kernel/locking/mutex.c:735 l2cap_unregister_user+0x6a/0x1c0 net/bluetooth/l2cap_core.c:1726 hidp_session_thread+0x450/0x490 net/bluetooth/hidp/core.c:1304 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Allocated by task 5924: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 poison_kmalloc_redzone mm/kasan/common.c:377 [inline] __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394 kasan_kmalloc include/linux/kasan.h:260 [inline] __do_kmalloc_node mm/slub.c:4298 [inline] __kmalloc_noprof+0x285/0x4c0 mm/slub.c:4310 kmalloc_noprof include/linux/slab.h:905 [inline] kzalloc_noprof include/linux/slab.h:1037 [inline] hci_alloc_dev_priv+0x27/0x2030 net/bluetooth/hci_core.c:2439 hci_alloc_dev include/net/bluetooth/hci_core.h:1693 [inline] __vhci_create_device drivers/bluetooth/hci_vhci.c:399 [inline] vhci_create_device+0x116/0x6a0 drivers/bluetooth/hci_vhci.c:470 vhci_get_user drivers/bluetooth/hci_vhci.c:527 [inline] vhci_write+0x3cf/0x490 drivers/bluetooth/hci_vhci.c:607 new_sync_write fs/read_write.c:586 [inline] vfs_write+0xaeb/0xd30 fs/read_write.c:679 ksys_write+0x18f/0x2b0 fs/read_write.c:731 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task 5924: kasan_save_stack mm/kasan/common.c:47 [inline] kasan_save_track+0x3f/0x80 mm/kasan/common.c:68 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582 poison_slab_object mm/kasan/common.c:247 [inline] __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264 kasan_slab_free include/linux/kasan.h:233 [inline] slab_free_hook mm/slub.c:2353 [inline] slab_free mm/slub.c:4613 [inline] kfree+0x196/0x430 mm/slub.c:4761 hci_release_dev+0x1525/0x16b0 net/bluetooth/hci_core.c:2758 bt_host_release+0x83/0x90 net/bluetooth/hci_sysfs.c:87 device_release+0x99/0x1c0 kobject_cleanup lib/kobject.c:689 [inline] kobject_release lib/kobject.c:720 [inline] kref_put include/linux/kref.h:65 [inline] kobject_put+0x22f/0x480 lib/kobject.c:737 vhci_release+0x88/0xd0 drivers/bluetooth/hci_vhci.c:665 __fput+0x23c/0xa50 fs/file_table.c:450 task_work_run+0x24f/0x310 kernel/task_work.c:239 exit_task_work include/linux/task_work.h:43 [inline] do_exit+0xa2f/0x28e0 kernel/exit.c:938 do_group_exit+0x207/0x2c0 kernel/exit.c:1087 get_signal+0x16b2/0x1750 kernel/signal.c:3017 arch_do_signal_or_restart+0x96/0x860 arch/x86/kernel/signal.c:337 exit_to_user_mode_loop kernel/entry/common.c:111 [inline] exit_to_user_mode_prepare include/linux/entry-common.h:329 [inline] __syscall_exit_to_user_mode_work kernel/entry/common.c:207 [inline] syscall_exit_to_user_mode+0xce/0x340 kernel/entry/common.c:218 do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89 entry_SYSCALL_64_after_hwframe+0x77/0x7f Last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 insert_work+0x3e/0x330 kernel/workqueue.c:2183 __queue_work+0xb66/0xf50 kernel/workqueue.c:2343 queue_work_on+0x1c2/0x380 kernel/workqueue.c:2390 process_one_work kernel/workqueue.c:3229 [inline] process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310 worker_thread+0x870/0xd30 kernel/workqueue.c:3391 kthread+0x2f0/0x390 kernel/kthread.c:389 ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244 Second to last potentially related work creation: kasan_save_stack+0x3f/0x60 mm/kasan/common.c:47 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544 insert_work+0x3e/0x330 kernel/workqueue.c:2183 __queue_work+0xc8b/0xf50 kernel/workqueue.c:2339 call_timer_fn+0x187/0x650 kernel/time/timer.c:1793 expire_timers kernel/time/timer.c:1839 [inline] __run_timers kernel/time/timer.c:2418 [inline] __run_timer_base+0x695/0x8e0 kernel/time/timer.c:2430 run_timer_base kernel/time/timer.c:2439 [inline] run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2449 handle_softirqs+0x2d4/0x9b0 kernel/softirq.c:561 __do_softirq kernel/softirq.c:595 [inline] invoke_softirq kernel/softirq.c:435 [inline] __irq_exit_rcu+0xf7/0x220 kernel/softirq.c:662 irq_exit_rcu+0x9/0x30 kernel/softirq.c:678 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 The buggy address belongs to the object at ffff8880122a4000 which belongs to the cache kmalloc-8k of size 8192 The buggy address is located 96 bytes inside of freed 8192-byte region [ffff8880122a4000, ffff8880122a6000) The buggy address belongs to the physical page: page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x122a0 head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) page_type: f5(slab) raw: 00fff00000000040 ffff88801ac42280 ffffea00009e0e00 0000000000000004 raw: 0000000000000000 0000000000020002 00000001f5000000 0000000000000000 head: 00fff00000000040 ffff88801ac42280 ffffea00009e0e00 0000000000000004 head: 0000000000000000 0000000000020002 00000001f5000000 0000000000000000 head: 00fff00000000003 ffffea000048a801 ffffffffffffffff 0000000000000000 head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as allocated page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5499, tgid 5499 (dhcpcd), ts 37935092058, free_ts 37934986027 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1556 prep_new_page mm/page_alloc.c:1564 [inline] get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3474 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4751 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2269 alloc_slab_page+0x6a/0x110 mm/slub.c:2423 allocate_slab+0x5a/0x2b0 mm/slub.c:2589 new_slab mm/slub.c:2642 [inline] ___slab_alloc+0xc27/0x14a0 mm/slub.c:3830 __slab_alloc+0x58/0xa0 mm/slub.c:3920 __slab_alloc_node mm/slub.c:3995 [inline] slab_alloc_node mm/slub.c:4156 [inline] __do_kmalloc_node mm/slub.c:4297 [inline] __kmalloc_node_track_caller_noprof+0x2e9/0x4c0 mm/slub.c:4317 kmalloc_reserve+0x111/0x2a0 net/core/skbuff.c:609 __alloc_skb+0x1f3/0x440 net/core/skbuff.c:678 alloc_skb include/linux/skbuff.h:1323 [inline] netlink_dump+0x1ee/0xe10 net/netlink/af_netlink.c:2283 __netlink_dump_start+0x5a2/0x790 net/netlink/af_netlink.c:2432 netlink_dump_start include/linux/netlink.h:340 [inline] rtnetlink_dump_start net/core/rtnetlink.c:6820 [inline] rtnetlink_rcv_msg+0xb3d/0xcf0 net/core/rtnetlink.c:6887 netlink_rcv_skb+0x1e3/0x430 net/netlink/af_netlink.c:2542 netlink_unicast_kernel net/netlink/af_netlink.c:1321 [inline] netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1347 page last free pid 5499 tgid 5499 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] free_pages_prepare mm/page_alloc.c:1127 [inline] free_unref_page+0xd3f/0x1010 mm/page_alloc.c:2657 discard_slab mm/slub.c:2688 [inline] __put_partials+0x160/0x1c0 mm/slub.c:3157 put_cpu_partial+0x17c/0x250 mm/slub.c:3232 __slab_free+0x290/0x380 mm/slub.c:4483 qlink_free mm/kasan/quarantine.c:163 [inline] qlist_free_all+0x9a/0x140 mm/kasan/quarantine.c:179 kasan_quarantine_reduce+0x14f/0x170 mm/kasan/quarantine.c:286 __kasan_slab_alloc+0x23/0x80 mm/kasan/common.c:329 kasan_slab_alloc include/linux/kasan.h:250 [inline] slab_post_alloc_hook mm/slub.c:4119 [inline] slab_alloc_node mm/slub.c:4168 [inline] kmem_cache_alloc_node_noprof+0x1d9/0x380 mm/slub.c:4220 __alloc_skb+0x1c3/0x440 net/core/skbuff.c:668 netlink_sendmsg+0x638/0xcb0 net/netlink/af_netlink.c:1866 sock_sendmsg_nosec net/socket.c:711 [inline] __sock_sendmsg+0x221/0x270 net/socket.c:726 __sys_sendto+0x363/0x4c0 net/socket.c:2197 __do_sys_sendto net/socket.c:2204 [inline] __se_sys_sendto net/socket.c:2200 [inline] __x64_sys_sendto+0xde/0x100 net/socket.c:2200 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Memory state around the buggy address: ffff8880122a3f00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff8880122a3f80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff8880122a4000: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff8880122a4080: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff8880122a4100: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ==================================================================