last executing test programs:
21.554818698s ago: executing program 1 (id=2):
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2})
ioctl$TUNATTACHFILTER(r0, 0x401054d5, &(0x7f0000000480)={0x2, &(0x7f00000004c0)=[{0x25, 0x0, 0x1, 0xffffffff}, {}]})
17.022276566s ago: executing program 0 (id=1):
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket(0x2b, 0x80801, 0x1)
setsockopt$ARPT_SO_SET_REPLACE(r0, 0xa02000000000000, 0x60, 0x0, 0x50)
bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x4, 0xe, 0x0, &(0x7f0000000340)='GPL\x00', 0xffffffff, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x2}, 0x8, 0x10, &(0x7f0000000100)={0x80000000}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x10001, @void, @value}, 0x94)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000740)={&(0x7f0000000cc0)=ANY=[@ANYBLOB="9feb010018000000000000003c0000003c0000000c0000000400000001000004010000000a00000003000000060000000a00000000000012020000000000000000000003000000000200000002000000000000000061002e2e61612e61005f009441eb654925fa1bc6c02b6f0720f15677076572e35d82ba18ca72d0883da1397e644e953ac948af0488427ab5ac4bfb8c02c3ddfe247f40f294268b0aef530eef410116d1afa60fc78846f0be2725a05a1ec81a337add20526700e7f8b1371d808615d72be92498cc829470fa77d06c39a7fd67d260b0e91a9564d6c9e908de23f67034cc2170560a0e34275164dda278a6f01ee605d48979f99fbbd8f7d3fab88ced9de5a851089e0dcc1ff37f8e7260693687a792ea9e24fb87784f122bb1e613157a205213d6065b45a9dcb0e9d4a737ff81067ad8bea5161602c9debda713ae2eea49ee8c5c59119b748efe5b1867bcc9e4fee906ad7da80cf7900f256172271a14d001b767c01087eb3a934891eab1ac"], 0x0, 0x60, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x28)
ioctl$sock_ipv6_tunnel_SIOCGET6RD(r0, 0x89f8, &(0x7f00000001c0)={'syztnl0\x00', 0x0})
bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f00000002c0)=0xffffffffffffffff, 0x4)
r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="02000000040000000800", @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000041fba7747b28a0664861af3b20b5fa121bbb89cd15d96c9b413e35df78e2c0dc78290cc781ca531f9db4711f171ef642a32477b168e8efa2cf2d03ddd3d6126f9c8879d29afd5ec1a192af74d2427f4b673627a510e1a2ebaac26ab06939e4013aec7231db1bcce423c2cbd0aa770e0b000000000000", @ANYRES32, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x50)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000080)={0x0, r1}, 0x8)
r2 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, 0x0, 0x0)
connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e24, @multicast1}, 0x10)
setsockopt$sock_int(r2, 0x1, 0xc, &(0x7f0000000000)=0x56, 0x4)
sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x0)
r4 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16)
connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10)
sendmmsg(r4, &(0x7f0000007fc0), 0x800001d, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0xd, 0x10, &(0x7f00000003c0)=ANY=[], 0x0, 0x8, 0x0, 0x0, 0x0, 0x32, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)
r5 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000100)=0x1, 0x4)
connect$inet6(r5, &(0x7f00000001c0)={0xa, 0x4000, 0xfffffffd, @loopback, 0x6}, 0x6e)
setsockopt$inet6_tcp_TCP_MD5SIG(r5, 0x6, 0xe, &(0x7f0000000280)={@in6={{0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, '\x00', 0x2d}}}, 0x0, 0x0, 0x38, 0x0, "0f424a2bc651a9f11381328af8daf6f4bd2827984afeb6b627cea1ba22d1af57aa193c5024c9e8b22a8796a538ed893952a1aa555418ba1b4d0bc0712c028ec32a9bc2fb29b52d39e8626bc90abcc02a"}, 0xd8)
setsockopt$SO_BINDTODEVICE(r5, 0x1, 0x19, &(0x7f0000000240)='tunl0\x00', 0x10)
setsockopt$inet6_tcp_TCP_REPAIR(r5, 0x6, 0x13, &(0x7f0000000000), 0x4)
sendmsg$inet(r5, &(0x7f0000000640)={0x0, 0x0, 0x0}, 0x30)
15.389411464s ago: executing program 1 (id=3):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0xb}, 0x1c)
listen(r0, 0x6)
syz_emit_ethernet(0x56, &(0x7f0000000140)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "0a8435", 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x8, 0xfffffff0}]}}}}}}}}, 0x0)
syz_emit_ethernet(0x56, &(0x7f00000001c0)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x20, 0x6, 0x0, @remote, @local, {[], {{0x0, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x2, 0x8, 0x1, 0x0, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x3, 0x300}]}}}}}}}}, 0x0)
12.101930133s ago: executing program 1 (id=4):
r0 = socket(0x10, 0x2, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=@ipv6_newrule={0x30, 0x20, 0xf5f77ca68843fb3, 0x0, 0x0, {0xa, 0x0, 0x80, 0x0, 0x1, 0x0, 0x0, 0x1}, [@FRA_SRC={0x14, 0x2, @remote}]}, 0x30}, 0x1, 0x0, 0x0, 0xe9f89a8a1aec08cc}, 0x4000040)
7.638941448s ago: executing program 1 (id=5):
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
r1 = socket(0x10, 0x3, 0x0)
r2 = socket$packet(0x11, 0x3, 0x300)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'bridge0\x00'})
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="680000000206011e0000000000000000000000000e0003006269746d61703a6970000000050004000a0000000900020073797a300000000020000780050003001c0000000c0001800800014008000000050014002000000005000500020000000500010006"], 0x68}}, 0x0)
r5 = socket(0x10, 0x80002, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000033c0)=ANY=[@ANYRES8=r0, @ANYRES64=r2, @ANYRESHEX=r0, @ANYRES32=r0, @ANYRES16=r0, @ANYRESDEC=r1, @ANYBLOB="b0fb85998a9e5eb183f91e89a7ec833f59bf16441be4a793aa7cc3a513c43c74b7c7d6a58b65514b82d8eb3a4fcac4b4e03fa7935c2a98b5e75dd5fb59709f6a3873b4fe5057bccfe93c1164cdd7d1dab5d6a9b97551dd7c36495b9cee18ba4e264799c1e2f0ba662740873d77d2ae0a8e6c9e0d714eb20ffe7802e51c7e40c9a959f928d1e837f19ba5d147a4b523510012"], 0x44}, 0x1, 0x0, 0x0, 0x800}, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)
unshare(0x20000400)
setsockopt$ARPT_SO_SET_ADD_COUNTERS(r5, 0x0, 0x61, 0x0, 0x0)
r6 = socket$inet(0x2, 0x1, 0x0)
setsockopt$sock_int(r6, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4)
shutdown(r6, 0x0)
recvmmsg(r6, &(0x7f00000066c0), 0xa0d, 0x0, 0x0)
r7 = socket$kcm(0x11, 0x2, 0x300)
setsockopt$sock_int(r7, 0x1, 0x28, &(0x7f00000002c0)=0x400, 0x4)
recvmsg(r7, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0)
recvmmsg(r1, &(0x7f0000000640)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}, 0x8}], 0x3, 0x40002002, 0x0)
write(r1, &(0x7f00000000c0)="240000001e005f0214fffffffffffff8070000001d00000000000000050009000d000000", 0x24)
setsockopt$packet_rx_ring(0xffffffffffffffff, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0xfffffffc, 0xff, 0x80000000}, 0x1c)
getsockopt$inet6_tcp_int(r0, 0x6, 0x24, 0x0, 0x0)
getsockopt$sock_cred(r5, 0x1, 0x11, 0x0, &(0x7f0000000240))
r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r8)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$packet(0x11, 0x2, 0x300)
0s ago: executing program 1 (id=6):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="02000000040000000100000022bf00000000", @ANYRES32, @ANYBLOB="3983ff000200"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/18], 0x48)
r1 = socket(0xa, 0x3, 0x87)
sendmmsg$unix(r1, &(0x7f0000004380)=[{{&(0x7f0000000200)=@abs={0x0, 0x0, 0x1}, 0x6e, &(0x7f00000003c0)=[{&(0x7f00000007c0)="d0", 0x1}], 0x1, 0x0, 0x0, 0x4}}], 0x1, 0x814)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000002c0)={'wlan0\x00', <r4=>0x0})
sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000100)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000001800000008000300", @ANYRES32=r4], 0x60}, 0x1, 0x0, 0x0, 0xc0}, 0x0)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000009c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020148100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000007000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0, r5}, 0x18)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0)
write$cgroup_subtree(0xffffffffffffffff, 0x0, 0xfdef)
r6 = socket$packet(0x11, 0xa, 0x300)
setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000fbe000)={0x1, &(0x7f0000000100)=[{0x80000006}]}, 0x10)
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFULNL_MSG_CONFIG(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x28, 0x1, 0x4, 0x801, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFULA_CFG_MODE={0xa, 0x2, {0x5, 0x1}}, @NFULA_CFG_CMD={0x5, 0x1, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x4080800}, 0x4000000)
r8 = socket$netlink(0x10, 0x3, 0x4)
write(r8, &(0x7f0000000040)="2700000014000707030e0000120f0a0011000100", 0x14)
bpf$MAP_CREATE_TAIL_CALL(0x0, 0x0, 0x48)
syz_open_procfs$namespace(0x0, 0x0)
writev(r8, &(0x7f0000000480)=[{&(0x7f0000000200)}, {&(0x7f00000002c0)="a0537d5ad02fb75468322b95eda4db23bb7c7be56e139b1b14488158cd23f443399347db4fc55ca1e40ce016e34b5f6ceafaefc10c4ba1114a55e26952928e36777c811878d18d0db88fd39a075c351ee8d17f844e3046db63f426b5a514ce1a00e999af4ba2510d40771d1a83dbeeb7c5ae63a1fde7140403a3817402fdff60a08b3045d320039c1a6eba059665ee543783132792c28b2df2f62d7b03fc561829d15216e9ab8d542a161779e1c57ecae3dd1cc6412fbde6464b85be62a889041535ae37a77e", 0xc6}, {0x0}], 0x3)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00'}, 0x10)
bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000440)={{r0, <r9=>0xffffffffffffffff}, &(0x7f00000003c0), &(0x7f0000000400)}, 0x20)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000740), &(0x7f00000007c0), 0xffffd6c0, r9, 0x0, 0x20}, 0x38)
r10 = socket$nl_route(0x10, 0x3, 0x0)
r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a)
ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'bridge0\x00', <r12=>0x0})
sendmsg$nl_route(r10, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000006c0)=ANY=[@ANYBLOB="4c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="1502ffffffa100001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32=r11, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r12], 0x4c}, 0x1, 0xba01}, 0x0)
kernel console output (not intermixed with test programs):
Warning: Permanently added '[localhost]:44284' (ED25519) to the list of known hosts.
syzkaller login: [ 341.949848][ T3169] cgroup: Unknown subsys name 'net'
[ 342.443777][ T3169] cgroup: Unknown subsys name 'cpuset'
[ 342.507438][ T3169] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[ 400.850156][ T3169] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k
[ 463.460373][ T3175] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 463.500974][ T3175] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 465.180301][ T3179] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[ 465.289442][ T3179] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[ 473.374977][ T3179] hsr_slave_0: entered promiscuous mode
[ 473.389547][ T3179] hsr_slave_1: entered promiscuous mode
[ 476.365670][ T3175] hsr_slave_0: entered promiscuous mode
[ 476.382241][ T3175] hsr_slave_1: entered promiscuous mode
[ 476.406244][ T3175] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[ 476.410023][ T3175] Cannot create hsr debugfs directory
[ 481.745281][ T3179] netdevsim netdevsim1 netdevsim0: renamed from eth0
[ 482.049671][ T3179] netdevsim netdevsim1 netdevsim1: renamed from eth1
[ 482.172561][ T3179] netdevsim netdevsim1 netdevsim2: renamed from eth2
[ 482.306111][ T3179] netdevsim netdevsim1 netdevsim3: renamed from eth3
[ 483.879045][ T3175] netdevsim netdevsim0 netdevsim0: renamed from eth0
[ 484.042292][ T3175] netdevsim netdevsim0 netdevsim1: renamed from eth1
[ 484.160348][ T3175] netdevsim netdevsim0 netdevsim2: renamed from eth2
[ 484.270148][ T3175] netdevsim netdevsim0 netdevsim3: renamed from eth3
[ 489.915112][ T3179] 8021q: adding VLAN 0 to HW filter on device bond0
[ 491.979660][ T3175] 8021q: adding VLAN 0 to HW filter on device bond0
[ 521.353858][ T3179] veth0_vlan: entered promiscuous mode
[ 521.687866][ T3179] veth1_vlan: entered promiscuous mode
[ 522.421008][ T3179] veth0_macvtap: entered promiscuous mode
[ 522.531590][ T3179] veth1_macvtap: entered promiscuous mode
[ 523.767202][ T3175] veth0_vlan: entered promiscuous mode
[ 524.226602][ T3179] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 524.231045][ T3179] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 524.234541][ T3179] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 524.236572][ T3179] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 524.581485][ T3175] veth1_vlan: entered promiscuous mode
[ 527.241252][ T3175] veth0_macvtap: entered promiscuous mode
[ 527.836966][ T3175] veth1_macvtap: entered promiscuous mode
[ 529.599372][ T3175] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[ 529.601830][ T3175] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[ 529.618103][ T3175] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[ 529.620893][ T3175] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[ 530.188851][ T3179] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[ 546.428377][ T3891] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[ 556.895979][ T3898] ==================================================================
[ 556.898176][ T3898] BUG: KASAN: global-out-of-bounds in memcmp+0xc0/0xca
[ 556.901381][ T3898] Read of size 1 at addr ffffffff89a26cc0 by task syz.1.6/3898
[ 556.903152][ T3898]
[ 556.905973][ T3898] CPU: 0 UID: 0 PID: 3898 Comm: syz.1.6 Not tainted 6.14.0-rc1-syzkaller-g245aece3750d #0
[ 556.906685][ T3898] Hardware name: riscv-virtio,qemu (DT)
[ 556.907284][ T3898] Call Trace:
[ 556.907687][ T3898] [<ffffffff80074518>] dump_backtrace+0x2e/0x3c
[ 556.908261][ T3898] [<ffffffff80003206>] show_stack+0x30/0x3c
[ 556.908726][ T3898] [<ffffffff8005fa4c>] dump_stack_lvl+0x12e/0x1a6
[ 556.909332][ T3898] [<ffffffff8000eac8>] print_report+0x28e/0x5aa
[ 556.909908][ T3898] [<ffffffff80a6e636>] kasan_report+0xf0/0x214
[ 556.910547][ T3898] [<ffffffff80a70424>] __asan_report_load1_noabort+0x12/0x1a
[ 556.911214][ T3898] [<ffffffff862196ca>] memcmp+0xc0/0xca
[ 556.911606][ T3898] [<ffffffff84fb59d6>] __hw_addr_add_ex+0xee/0x676
[ 556.912090][ T3898] [<ffffffff84fb7c1c>] dev_mc_add+0xac/0x108
[ 556.912605][ T3898] [<ffffffff8515d568>] mrp_init_applicant+0xe8/0x56e
[ 556.913132][ T3898] [<ffffffff85d7dc92>] vlan_mvrp_init_applicant+0x26/0x30
[ 556.913664][ T3898] [<ffffffff85d73d42>] register_vlan_dev+0x1b4/0x922
[ 556.914086][ T3898] [<ffffffff85d7c35a>] vlan_newlink+0x3ca/0x5fa
[ 556.914592][ T3898] [<ffffffff84fed52c>] rtnl_newlink+0xbb4/0x1acc
[ 556.915034][ T3898] [<ffffffff84ff025c>] rtnetlink_rcv_msg+0x9e2/0xdbe
[ 556.915500][ T3898] [<ffffffff85335f8c>] netlink_rcv_skb+0x216/0x3dc
[ 556.916050][ T3898] [<ffffffff84fddfa2>] rtnetlink_rcv+0x26/0x30
[ 556.916686][ T3898] [<ffffffff85334240>] netlink_unicast+0x4f0/0x82c
[ 556.917224][ T3898] [<ffffffff85334de0>] netlink_sendmsg+0x864/0xdc6
[ 556.917782][ T3898] [<ffffffff84ed379a>] __sock_sendmsg+0xcc/0x160
[ 556.918198][ T3898] [<ffffffff84ed43a6>] ____sys_sendmsg+0x5ce/0x79e
[ 556.918681][ T3898] [<ffffffff84edcf18>] ___sys_sendmsg+0x144/0x1e6
[ 556.919165][ T3898] [<ffffffff84eddcce>] __sys_sendmsg+0x188/0x22a
[ 556.919654][ T3898] [<ffffffff84eddde0>] __riscv_sys_sendmsg+0x70/0xa2
[ 556.920159][ T3898] [<ffffffff80072b1e>] syscall_handler+0x94/0x118
[ 556.920665][ T3898] [<ffffffff86242a5a>] do_trap_ecall_u+0x1aa/0x216
[ 556.921259][ T3898] [<ffffffff86268776>] handle_exception+0x146/0x152
[ 556.922197][ T3898]
[ 556.946554][ T3898] The buggy address belongs to the variable:
[ 556.947613][ T3898] vlan_mrp_app+0x60/0x3e80
[ 556.948835][ T3898]
[ 556.949662][ T3898] The buggy address belongs to the physical page:
[ 556.951319][ T3898] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x89c26
[ 556.952996][ T3898] flags: 0xffe000000002000(reserved|node=0|zone=0|lastcpupid=0x7ff)
[ 556.956118][ T3898] raw: 0ffe000000002000 ffff8d8000270988 ffff8d8000270988 0000000000000000
[ 556.957641][ T3898] raw: 0000000000000000 0000000000000000 00000001ffffffff 0000000000000000
[ 556.959162][ T3898] page dumped because: kasan: bad access detected
[ 556.960635][ T3898] page_owner info is not present (never set?)
[ 556.961786][ T3898]
[ 556.962577][ T3898] Memory state around the buggy address:
[ 556.964448][ T3898] ffffffff89a26b80: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
[ 556.965797][ T3898] ffffffff89a26c00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 556.967116][ T3898] >ffffffff89a26c80: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
[ 556.968318][ T3898] ^
[ 556.969564][ T3898] ffffffff89a26d00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
[ 556.970915][ T3898] ffffffff89a26d80: f9 f9 f9 f9 00 00 00 00 f9 f9 f9 f9 00 00 00 00
[ 556.972254][ T3898] ==================================================================
[ 556.976950][ T3898] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[ 556.979143][ T3898] CPU: 0 UID: 0 PID: 3898 Comm: syz.1.6 Not tainted 6.14.0-rc1-syzkaller-g245aece3750d #0
[ 556.980644][ T3898] Hardware name: riscv-virtio,qemu (DT)
[ 556.981639][ T3898] Call Trace:
[ 556.982524][ T3898] [<ffffffff80074518>] dump_backtrace+0x2e/0x3c
[ 556.984029][ T3898] [<ffffffff80003206>] show_stack+0x30/0x3c
[ 556.985224][ T3898] [<ffffffff8005fa2e>] dump_stack_lvl+0x110/0x1a6
[ 556.986691][ T3898] [<ffffffff8005fae0>] dump_stack+0x1c/0x24
[ 556.988069][ T3898] [<ffffffff80003b36>] panic+0x38c/0x86a
[ 556.989323][ T3898] [<ffffffff8013aabe>] check_panic_on_warn+0xc0/0xe4
[ 556.990762][ T3898] [<ffffffff8000e7da>] end_report.part.0+0x4e/0xae
[ 556.992181][ T3898] [<ffffffff80a6e680>] kasan_report+0x13a/0x214
[ 556.993678][ T3898] [<ffffffff80a70424>] __asan_report_load1_noabort+0x12/0x1a
[ 556.995248][ T3898] [<ffffffff862196ca>] memcmp+0xc0/0xca
[ 556.996467][ T3898] [<ffffffff84fb59d6>] __hw_addr_add_ex+0xee/0x676
[ 556.997817][ T3898] [<ffffffff84fb7c1c>] dev_mc_add+0xac/0x108
[ 556.999174][ T3898] [<ffffffff8515d568>] mrp_init_applicant+0xe8/0x56e
[ 557.000545][ T3898] [<ffffffff85d7dc92>] vlan_mvrp_init_applicant+0x26/0x30
[ 557.001892][ T3898] [<ffffffff85d73d42>] register_vlan_dev+0x1b4/0x922
[ 557.003418][ T3898] [<ffffffff85d7c35a>] vlan_newlink+0x3ca/0x5fa
[ 557.004711][ T3898] [<ffffffff84fed52c>] rtnl_newlink+0xbb4/0x1acc
[ 557.006187][ T3898] [<ffffffff84ff025c>] rtnetlink_rcv_msg+0x9e2/0xdbe
[ 557.007783][ T3898] [<ffffffff85335f8c>] netlink_rcv_skb+0x216/0x3dc
[ 557.009190][ T3898] [<ffffffff84fddfa2>] rtnetlink_rcv+0x26/0x30
[ 557.010714][ T3898] [<ffffffff85334240>] netlink_unicast+0x4f0/0x82c
[ 557.012142][ T3898] [<ffffffff85334de0>] netlink_sendmsg+0x864/0xdc6
[ 557.013677][ T3898] [<ffffffff84ed379a>] __sock_sendmsg+0xcc/0x160
[ 557.014998][ T3898] [<ffffffff84ed43a6>] ____sys_sendmsg+0x5ce/0x79e
[ 557.016282][ T3898] [<ffffffff84edcf18>] ___sys_sendmsg+0x144/0x1e6
[ 557.017710][ T3898] [<ffffffff84eddcce>] __sys_sendmsg+0x188/0x22a
[ 557.019189][ T3898] [<ffffffff84eddde0>] __riscv_sys_sendmsg+0x70/0xa2
[ 557.020566][ T3898] [<ffffffff80072b1e>] syscall_handler+0x94/0x118
[ 557.021869][ T3898] [<ffffffff86242a5a>] do_trap_ecall_u+0x1aa/0x216
[ 557.023551][ T3898] [<ffffffff86268776>] handle_exception+0x146/0x152
[ 557.025481][ T3898] SMP: stopping secondary CPUs
[ 557.029032][ T3898] Rebooting in 86400 seconds..
VM DIAGNOSIS:
01:48:24 Registers:
info registers vcpu 0
CPU#0
V = 0
pc ffffffff86219b84
mhartid 0000000000000000
mstatus 0000000a000000a0
hstatus 0000000200000000
vsstatus 0000000a00000000
mip 0000000000000220
mie 000000000000022a
mideleg 0000000000001666
hideleg 0000000000000444
medeleg 0000000000f0b509
hedeleg 000000000000b109
mtvec 00000000800004f0
stvec ffffffff86268630
vstvec 0000000000000000
mepc ffffffff85d7c39c
sepc ffffffff8624343e
vsepc 0000000000000000
mcause 8000000000000003
scause 8000000000000005
vscause 0000000000000000
mtval 0000000000000000
stval 0000000000000000
htval 0000000000000000
mtval2 0000000000000000
mscratch 000000008004a000
sscratch 0000000000000000
satp 901b70000009170f
x0/zero 0000000000000000 x1/ra ffffffff802f172a x2/sp ffff8f800d446510 x3/gp ffffffff89c1d3c0
x4/tp ffffaf801a100000 x5/t0 ffff8f800d4465c0 x6/t1 0000000000000054 x7/t2 7320666f20646165
x8/s0 ffff8f800d446550 x9/s1 ffff8f800d446720 x10/a0 ffffffff90dda2a0 x11/a1 000000000000000a
x12/a2 ffffffff90dda2a0 x13/a3 ffffffff802f171c x14/a4 fffffffef21bb454 x15/a5 0000000000000000
x16/a6 0000000000000003 x17/a7 ffff8f800d446527 x18/s2 dfffffff00000000 x19/s3 ffffffff90dda2a0
x20/s4 0000000000000000 x21/s5 0000000000000017 x22/s6 0000000000000000 x23/s7 0000000000000800
x24/s8 ffff8f800d4465b0 x25/s9 0000000000000000 x26/s10 00000000000007e7 x27/s11 1ffff1f001a88ce6
x28/t3 ffff8f800d4465c0 x29/t4 ffff8f800d4465c0 x30/t5 fffff1ef01a88ca5 x31/t6 ffff8f800d4465c6
fcsr 0000000000000000
f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000
f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000
f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000
f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000
f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000
f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000
f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000
f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000
info registers vcpu 1
CPU#1
V = 0
pc ffffffff804dba0c
mhartid 0000000000000001
mstatus 0000000a000000a0
hstatus 0000000200000000
vsstatus 0000000a00000000
mip 0000000000000000
mie 000000000000022a
mideleg 0000000000001666
hideleg 0000000000000444
medeleg 0000000000f0b509
hedeleg 000000000000b109
mtvec 00000000800004f0
stvec ffffffff86268630
vstvec 0000000000000000
mepc ffffffff80088636
sepc ffffffff8099b22e
vsepc 0000000000000000
mcause 0000000000000009
scause 8000000000000005
vscause 0000000000000000
mtval 0000000000000000
stval 0000000000000000
htval 0000000000000000
mtval2 0000000000000000
mscratch 0000000080048000
sscratch 0000000000000000
satp 901a800000098249
x0/zero 0000000000000000 x1/ra ffffffff81dff80e x2/sp ffff8f80001e75c0 x3/gp ffffffff89c1d3c0
x4/tp ffffaf80136c8000 x5/t0 ffffaf801da78ee0 x6/t1 0000000000000000 x7/t2 000000000000001b
x8/s0 ffff8f80001e75f0 x9/s1 ffffffff89d27260 x10/a0 ffffffff90fcb3a8 x11/a1 0000000000000000
x12/a2 0000000000000008 x13/a3 fffffffff3f3f3f3 x14/a4 1ffff5f0026d917a x15/a5 000000003e762adb
x16/a6 ffffffff8d421760 x17/a7 fffffffff848db56 x18/s2 ffffffff8a82d1c0 x19/s3 0000000000000008
x20/s4 ffffffff90fcb3a0 x21/s5 0000000000000006 x22/s6 ffff8f80001e7820 x23/s7 ffffaf801da78000
x24/s8 ffffaf806ed87a70 x25/s9 1ffff5f00ddb0f52 x26/s10 ffffaf806ed87a90 x27/s11 ffffffff88ab7180
x28/t3 ffffaf80136c8b30 x29/t4 1ffff5f0026d9165 x30/t5 1ffff5f0026d917e x31/t6 ffff8f80001e7850
fcsr 0000000000000000
f0/ft0 0000000000000000 f1/ft1 0000000000000000 f2/ft2 0000000000000000 f3/ft3 0000000000000000
f4/ft4 0000000000000000 f5/ft5 0000000000000000 f6/ft6 0000000000000000 f7/ft7 0000000000000000
f8/fs0 0000000000000000 f9/fs1 0000000000000000 f10/fa0 0000000000000000 f11/fa1 0000000000000000
f12/fa2 0000000000000000 f13/fa3 0000000000000000 f14/fa4 0000000000000000 f15/fa5 0000000000000000
f16/fa6 0000000000000000 f17/fa7 0000000000000000 f18/fs2 0000000000000000 f19/fs3 0000000000000000
f20/fs4 0000000000000000 f21/fs5 0000000000000000 f22/fs6 0000000000000000 f23/fs7 0000000000000000
f24/fs8 0000000000000000 f25/fs9 0000000000000000 f26/fs10 0000000000000000 f27/fs11 0000000000000000
f28/ft8 0000000000000000 f29/ft9 0000000000000000 f30/ft10 0000000000000000 f31/ft11 0000000000000000