Extracting prog: 7m49.684837624s Minimizing prog: 2h45m54.209868652s Simplifying prog options: 12m11.150336237s Extracting C: 5m5.667105259s Simplifying C: 0s extracting reproducer from 25 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000700)={0x1, @default, @bpq0, 0x2, 'syz0\x00', @null, 0x1, 0x1, [@null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @bcast, @default, @default]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash single: failed to extract reproducer bisect: bisecting 25 programs with base timeout 30s testing program (duration=36s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 3, 14, 13, 11, 13, 3, 3, 5, 3, 2, 12, 1, 3, 3, 1, 6, 4, 4, 5, 3, 5, 5, 7, 12] detailed listing: executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000d00)='ns/pid_for_children\x00') ioctl$BTRFS_IOC_RM_DEV(r1, 0x5000940b, 0x0) r2 = socket(0x40000000015, 0x5, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x20000}, 0x24}}, 0x0) getsockname$packet(r4, 0x0, &(0x7f0000001480)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0xf0b, 0x4, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0xd}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=@newtfilter={0x54, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfff3}, {}, {0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x93}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x10, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x3}]}]}]}}]}, 0x54}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x114, 0x2d, 0x1, 0x0, 0x4, "", [@nested={0x104, 0x0, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@loopback={0x100000000000000}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8cd1"]}]}, 0x114}], 0x1}, 0x0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x54, 0x2, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0xfffe}, [@IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9efffffd}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x54}}, 0x0) bind$inet(r2, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) r7 = socket(0x15, 0x5, 0x0) r8 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r8, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000700)=ANY=[@ANYBLOB="e000000010000b0500000000000200006f6d8864d22a3f2ffaa46c88bcbd0000002b0e13e735a3184f1b3d6da2f1acfac0ee50d2b184b27db1f302de337c0004060000000000bf852c89867f6691b01b2d44e4ff282d2d2c"], 0xe0}], 0x1}, 0x0) getsockopt(r7, 0x200000000114, 0x2716, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000006800e97800000000000000000a000e000000000004002400"], 0x1c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYRES32=0x0, @ANYBLOB="7b130000000000003800128008000100677470002c00028008000100", @ANYRES16=r1, @ANYRES16=r9], 0x60}}, 0x0) socket$netlink(0x10, 0x3, 0x0) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000140)='memory.current\x00', 0x275a, 0x0) executing program 2: r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = socket$inet(0xa, 0x801, 0x84) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x2, 0x7a}, 0x8) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) syz_emit_ethernet(0xd2, &(0x7f0000001880)=ANY=[], 0x0) r3 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r3, &(0x7f0000ed3fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) shutdown(r3, 0x0) setsockopt$sock_linger(r3, 0x1, 0xd, 0x0, 0x0) sendto$inet6(r3, &(0x7f0000000100)="bc", 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) close(r3) executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, 0x0, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000000)={r3, 0x1, 0x6, @local}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000008c0)=@newqdisc={0xb8, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x88, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0xffff7fff}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xc, [0x1, 0xd, 0xf, 0x10, 0x1, 0x3, 0xa, 0x7, 0x2, 0xd, 0x10, 0x6, 0xc, 0x1, 0x8, 0x6], 0x0, [0x4, 0x9, 0xe, 0x719, 0xdb2, 0x9, 0x5, 0xe, 0x0, 0xfff8, 0x6, 0x100, 0x1, 0x1, 0x8c, 0x23f], [0x7, 0x800, 0xb3, 0x3, 0x3, 0x1, 0x8, 0x7, 0xfff8, 0xa1, 0x4, 0xfc01, 0x1, 0x2, 0x7f, 0xfff7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x10}, @TCA_TAPRIO_ATTR_FLAGS={0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x40}, @TCA_TAPRIO_ATTR_TXTIME_DELAY={0x8, 0xb, 0x80000000}]}}]}, 0xb8}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}]}, &(0x7f0000000180)=0x10) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r4, 0x84, 0x81, &(0x7f0000000000)="8f00ac18f9ff0000", 0x8) executing program 2: pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) socket$packet(0x11, 0x3, 0x300) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$kcm(0x2, 0xa, 0x2) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000080) write(r1, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0xffffff0c) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_netfilter(0x10, 0x3, 0xc) splice(r0, 0x0, r2, 0x0, 0x1100000000f335, 0x8) close(0x3) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x24000080) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e22, @multicast2}, 0x10) sendto$inet(r1, &(0x7f00000001c0)='p', 0x1, 0x0, 0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000280)=0x40) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x3, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-384-generic\x00'}, 0x59) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e00), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000a00)=ANY=[@ANYBLOB="2c010000", @ANYRES16=r1, @ANYBLOB="01000000000000000000170000000c00060001000000010000000c01308014000400976f1044852bca665354bd217b6b9037200001800c000500040000000300000008000100030000000500020000000000050002000800000024"], 0x12c}, 0x1, 0x0, 0x0, 0x20000020}, 0x0) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x15) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f0000000140)=[{&(0x7f00000001c0)="390000001300034700bb5be1c32988ff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000001c0)={@void, @void, @eth={@empty, @remote, @val={@void, {0x8100, 0x3, 0x0, 0x2}}, {@mpls_mc={0x86dd, {[], @llc={@llc={0x4, 0x80, '\x00', "3890e48d437facebd7a63178b6debc0e7be868dd240e48b8177a1996876937c42b808386e14d"}}}}}}}, 0x3b) executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e00), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000a00)=ANY=[@ANYBLOB="2c010000", @ANYRES16=r1, @ANYBLOB="01000000000000000000170000000c00060001000000010000000c01308014000400976f1044852bca665354bd217b6b9037200001800c000500040000000300000008000100030000000500020000000000050002000800000024"], 0x12c}, 0x1, 0x0, 0x0, 0x20000020}, 0x0) executing program 1: r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000400)="89000000120081ae08060cdc03a6000000000002000000006ee2ffca1b1f0000000004c00e72f750375ed08a563319bf9ed720000000d6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100002400d0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece0195b49e33538afa8af92347514f0b56a20ff27fff00"/137, 0x89}], 0x1}, 0x0) executing program 1: r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040), 0x10) listen(r0, 0x0) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) shutdown(r1, 0x1) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) accept4(r0, 0x0, 0x0, 0x80800) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0xa, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) executing program 3: bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000400)={@fallback, 0xffffffffffffffff, 0x1, 0x0, 0x0, @void, @value}, 0x20) executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e00), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000a00)=ANY=[@ANYBLOB="2c010000", @ANYRES16=r1, @ANYBLOB="01000000000000000000170000000c00060001000000010000000c01308014000400976f1044852bca665354bd217b6b9037200001800c00050004000000030000000800010003000000050002000000000005000200080000002400"], 0x12c}, 0x1, 0x0, 0x0, 0x20000020}, 0x0) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_vlan\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000001e00431b000000000000000007000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r1], 0x28}}, 0x0) executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1f, 0x3, &(0x7f00000015c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x80ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ed5696c5820fae0000000000000080beef911d564c", 0x15) r1 = accept4(r0, 0x0, 0x0, 0x80000) sendmmsg$unix(r1, &(0x7f00000020c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44081}}], 0x1, 0x88) read(r1, &(0x7f0000000480)=""/58, 0x3a) executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newsa={0x17c, 0x10, 0x633, 0x0, 0x0, {{@in6=@private0, @in=@broadcast, 0x0, 0x4000, 0x0, 0x8004}, {@in=@dev, 0x0, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x1a}, {0x327, 0x0, 0x0, 0x0, 0xfff}, {}, {0x8f}, 0x70bd29, 0x0, 0xa, 0x4}, [@encap={0x1c, 0x20, {0x0, 0x4e22, 0x0, @in=@remote}}, @algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0x2, 0x5e21, 0x0, @in=@rand_addr=0x64010101}}, @offload={0xc, 0x1c, {0x0, 0x3}}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) executing program 3: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="21012cbd7000000000001400000008000300", @ANYRES32=r2, @ANYBLOB="0a01000000"], 0x28}, 0x1, 0x0, 0x0, 0x20000004}, 0x4040) executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, 0x0, 0x0, 0x832b, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000040)=0x7, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="180000000210"], 0x18}}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)) bind$unix(r1, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000001100)=@req3={0x8000, 0x200, 0x80, 0x20000}, 0x1c) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r1}, 0x10) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r0, 0x0) executing program 0: unshare(0x22020400) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-aesni)\x00'}, 0x58) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000004000000b703000008000040850000006900000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f00000002c0)='sys_enter\x00', r2}, 0x10) accept4(r0, 0x0, 0x0, 0x0) executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000700)={0x1, @default, @bpq0, 0x2, 'syz0\x00', @null, 0x1, 0x1, [@null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @bcast, @default, @default]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000700)={0x1, @default, @bpq0, 0x2, 'syz0\x00', @null, 0x1, 0x1, [@null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @bcast, @default, @default]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash single: failed to extract reproducer bisect: bisecting 25 programs with base timeout 1m40s testing program (duration=1m46s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [25, 3, 14, 13, 11, 13, 3, 3, 5, 3, 2, 12, 1, 3, 3, 1, 6, 4, 4, 5, 3, 5, 5, 7, 12] detailed listing: executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000d00)='ns/pid_for_children\x00') ioctl$BTRFS_IOC_RM_DEV(r1, 0x5000940b, 0x0) r2 = socket(0x40000000015, 0x5, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r4 = socket(0x2a, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000005c0)=@newqdisc={0x24, 0x24, 0x0, 0x0, 0x20000}, 0x24}}, 0x0) getsockname$packet(r4, 0x0, &(0x7f0000001480)) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0xf0b, 0x4, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0xd}}}, 0x24}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000480)=@newtfilter={0x54, 0x2c, 0xd27, 0x70bd2d, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0x1, 0xfff3}, {}, {0x5}}, [@filter_kind_options=@f_flower={{0xb}, {0x24, 0x2, [@TCA_FLOWER_KEY_ENC_OPTS_MASK={0x10, 0x55, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x93}]}]}, @TCA_FLOWER_KEY_ENC_OPTS={0x10, 0x54, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPTS_VXLAN={0xc, 0x2, 0x0, 0x1, [@TCA_FLOWER_KEY_ENC_OPT_VXLAN_GBP={0x8, 0x1, 0x3}]}]}]}}]}, 0x54}}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)={0x114, 0x2d, 0x1, 0x0, 0x4, "", [@nested={0x104, 0x0, 0x0, 0x1, [@typed={0xc, 0x0, 0x0, 0x0, @u64}, @typed={0x14, 0x1, 0x0, 0x0, @ipv6=@loopback={0x100000000000000}}, @generic="50bb2d6f67d29d6fabadb107d0def49c88ea04abde1d5e8d3fb22a1b5046778bdafefc46b0449ade68bf84b36ec72dd71265fc2e882348c26c2126237dd5b37f5ae655b1086cda40e00aec58754734be31d750351dc076eb43d9621dc08c029d1608a487f26fbe816b89f7cb81bff81a8b9482565856555ee923c65973deb0a99b962bc0fe94a3fcae3697bd7b85b3a682167c43dbf137115a40ebddcad74875ec58e9a3ddb9ad02a078cf0d972df9e99f079767734f69ce475f55ac64337803f5eb4e5842f4d98fe3fa370d47eb640dc5061dc35817c8a66c29be82fd3f8cd1"]}]}, 0x114}], 0x1}, 0x0) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x54, 0x2, 0x6, 0x101, 0x0, 0x0, {0x0, 0x0, 0xfffe}, [@IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x9efffffd}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x54}}, 0x0) bind$inet(r2, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) r7 = socket(0x15, 0x5, 0x0) r8 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$netlink(r8, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000700)=ANY=[@ANYBLOB="e000000010000b0500000000000200006f6d8864d22a3f2ffaa46c88bcbd0000002b0e13e735a3184f1b3d6da2f1acfac0ee50d2b184b27db1f302de337c0004060000000000bf852c89867f6691b01b2d44e4ff282d2d2c"], 0xe0}], 0x1}, 0x0) getsockopt(r7, 0x200000000114, 0x2716, &(0x7f0000c35fff)=""/1, &(0x7f0000000000)=0xf002) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="1c0000006800e97800000000000000000a000e000000000004002400"], 0x1c}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYRES32=r0, @ANYRES32=0x0, @ANYBLOB="7b130000000000003800128008000100677470002c00028008000100", @ANYRES16=r1, @ANYRES16=r9], 0x60}}, 0x0) socket$netlink(0x10, 0x3, 0x0) executing program 2: mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) openat$cgroup_ro(r0, &(0x7f0000000140)='memory.current\x00', 0x275a, 0x0) executing program 2: r0 = socket$igmp6(0xa, 0x3, 0x2) r1 = socket$inet(0xa, 0x801, 0x84) r2 = accept4(r1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r2, 0x84, 0x7b, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r2, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x2, 0x7a}, 0x8) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000b00)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0x0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x0, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) syz_emit_ethernet(0xd2, &(0x7f0000001880)=ANY=[], 0x0) r3 = socket$inet6(0xa, 0x1, 0x84) bind$inet6(r3, &(0x7f0000ed3fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) shutdown(r3, 0x0) setsockopt$sock_linger(r3, 0x1, 0xd, 0x0, 0x0) sendto$inet6(r3, &(0x7f0000000100)="bc", 0x1, 0x0, &(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) close(r3) executing program 2: r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) bind$bt_l2cap(r0, 0x0, 0x0) setsockopt$bt_BT_RCVMTU(r0, 0x112, 0xd, 0x0, 0x0) r1 = socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r2, 0x8933, &(0x7f0000000180)={'batadv_slave_1\x00', 0x0}) setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000000)={r3, 0x1, 0x6, @local}, 0x10) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000008c0)=@newqdisc={0xb8, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x88, 0x2, [@TCA_TAPRIO_ATTR_FLAGS={0x8, 0xa, 0xffff7fff}, @TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0xc, [0x1, 0xd, 0xf, 0x10, 0x1, 0x3, 0xa, 0x7, 0x2, 0xd, 0x10, 0x6, 0xc, 0x1, 0x8, 0x6], 0x0, [0x4, 0x9, 0xe, 0x719, 0xdb2, 0x9, 0x5, 0xe, 0x0, 0xfff8, 0x6, 0x100, 0x1, 0x1, 0x8c, 0x23f], [0x7, 0x800, 0xb3, 0x3, 0x3, 0x1, 0x8, 0x7, 0xfff8, 0xa1, 0x4, 0xfc01, 0x1, 0x2, 0x7f, 0xfff7]}}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x10}, @TCA_TAPRIO_ATTR_FLAGS={0x8}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc, 0x3, 0x40}, @TCA_TAPRIO_ATTR_TXTIME_DELAY={0x8, 0xb, 0x80000000}]}}]}, 0xb8}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000001c0)=[@in6={0xa, 0x4e21, 0x7ff, @private2, 0xeb2}]}, &(0x7f0000000180)=0x10) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt(r4, 0x84, 0x81, &(0x7f0000000000)="8f00ac18f9ff0000", 0x8) executing program 2: pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) socket$packet(0x11, 0x3, 0x300) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) socket$kcm(0x2, 0xa, 0x2) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000080) write(r1, &(0x7f0000000000)="fc0000001d000724ab09254ec100070007ab08001b000000f0ffff002100057e0000000000000e000039000000039815fad151ba0101099cecb94b46fe0000000a00020025", 0xffffff0c) r2 = socket$inet_udp(0x2, 0x2, 0x0) close(r2) socket$nl_netfilter(0x10, 0x3, 0xc) splice(r0, 0x0, r2, 0x0, 0x1100000000f335, 0x8) close(0x3) executing program 2: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x24000080) r1 = socket$inet_smc(0x2b, 0x1, 0x0) bind$inet(r1, &(0x7f0000000140)={0x2, 0x4e22, @multicast2}, 0x10) sendto$inet(r1, &(0x7f00000001c0)='p', 0x1, 0x0, 0x0, 0x0) getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r1, 0x6, 0x23, &(0x7f0000000240)={&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, &(0x7f0000000280)=0x40) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x3, 0x300) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-384-generic\x00'}, 0x59) r4 = accept4(r3, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e00), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000a00)=ANY=[@ANYBLOB="2c010000", @ANYRES16=r1, @ANYBLOB="01000000000000000000170000000c00060001000000010000000c01308014000400976f1044852bca665354bd217b6b9037200001800c000500040000000300000008000100030000000500020000000000050002000800000024"], 0x12c}, 0x1, 0x0, 0x0, 0x20000020}, 0x0) executing program 1: r0 = socket$netlink(0x10, 0x3, 0x15) writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000280)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r0, &(0x7f0000000140)=[{&(0x7f00000001c0)="390000001300034700bb5be1c32988ff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) executing program 1: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000001c0)={@void, @void, @eth={@empty, @remote, @val={@void, {0x8100, 0x3, 0x0, 0x2}}, {@mpls_mc={0x86dd, {[], @llc={@llc={0x4, 0x80, '\x00', "3890e48d437facebd7a63178b6debc0e7be868dd240e48b8177a1996876937c42b808386e14d"}}}}}}}, 0x3b) executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e00), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000a00)=ANY=[@ANYBLOB="2c010000", @ANYRES16=r1, @ANYBLOB="01000000000000000000170000000c00060001000000010000000c01308014000400976f1044852bca665354bd217b6b9037200001800c000500040000000300000008000100030000000500020000000000050002000800000024"], 0x12c}, 0x1, 0x0, 0x0, 0x20000020}, 0x0) executing program 1: r0 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000400)="89000000120081ae08060cdc03a6000000000002000000006ee2ffca1b1f0000000004c00e72f750375ed08a563319bf9ed720000000d6e747033a0093b837dc6cc01e32efaec8c7a6ec0012100002400d0c0c00bdad446b9bbc7a46e3988285dcdf12f21308f868fece0195b49e33538afa8af92347514f0b56a20ff27fff00"/137, 0x89}], 0x1}, 0x0) executing program 1: r0 = socket(0x28, 0x5, 0x0) bind$vsock_stream(r0, &(0x7f0000000040), 0x10) listen(r0, 0x0) r1 = socket(0x28, 0x5, 0x0) connect$vsock_stream(r1, &(0x7f0000000080), 0x10) shutdown(r1, 0x1) r2 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r3}, 0x10) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) accept4(r0, 0x0, 0x0, 0x80800) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0xa, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) executing program 3: bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000400)={@fallback, 0xffffffffffffffff, 0x1, 0x0, 0x0, @void, @value}, 0x20) executing program 0: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000e00), 0xffffffffffffffff) sendmsg$NL802154_CMD_NEW_SEC_KEY(r0, &(0x7f00000010c0)={0x0, 0x0, &(0x7f0000001080)={&(0x7f0000000a00)=ANY=[@ANYBLOB="2c010000", @ANYRES16=r1, @ANYBLOB="01000000000000000000170000000c00060001000000010000000c01308014000400976f1044852bca665354bd217b6b9037200001800c00050004000000030000000800010003000000050002000000000005000200080000002400"], 0x12c}, 0x1, 0x0, 0x0, 0x20000020}, 0x0) executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'veth0_vlan\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000001e00431b000000000000000007000000", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r1], 0x28}}, 0x0) executing program 0: bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1f, 0x3, &(0x7f00000015c0)=@framed={{0x18, 0x0, 0x0, 0x0, 0x1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, '\x00', 0x0, @fallback=0x80ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(des3_ede)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ed5696c5820fae0000000000000080beef911d564c", 0x15) r1 = accept4(r0, 0x0, 0x0, 0x80000) sendmmsg$unix(r1, &(0x7f00000020c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44081}}], 0x1, 0x88) read(r1, &(0x7f0000000480)=""/58, 0x3a) executing program 0: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=@newsa={0x17c, 0x10, 0x633, 0x0, 0x0, {{@in6=@private0, @in=@broadcast, 0x0, 0x4000, 0x0, 0x8004}, {@in=@dev, 0x0, 0x32}, @in6=@dev={0xfe, 0x80, '\x00', 0x1a}, {0x327, 0x0, 0x0, 0x0, 0xfff}, {}, {0x8f}, 0x70bd29, 0x0, 0xa, 0x4}, [@encap={0x1c, 0x20, {0x0, 0x4e22, 0x0, @in=@remote}}, @algo_crypt={0x48, 0x2, {{'ecb(cipher_null)\x00'}}}, @encap={0x1c, 0x4, {0x2, 0x5e21, 0x0, @in=@rand_addr=0x64010101}}, @offload={0xc, 0x1c, {0x0, 0x3}}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$inet(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{0x0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) executing program 3: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000005c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DEL_STATION(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="21012cbd7000000000001400000008000300", @ANYRES32=r2, @ANYBLOB="0a01000000"], 0x28}, 0x1, 0x0, 0x0, 0x20000004}, 0x4040) executing program 0: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r0, 0x0, 0x0, 0x832b, 0x0) setsockopt$inet6_int(r0, 0x29, 0x4a, &(0x7f0000000040)=0x7, 0x4) sendto$inet6(r0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) executing program 3: r0 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SET(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB="180000000210"], 0x18}}, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r1, 0x5452, &(0x7f0000000000)) bind$unix(r1, &(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e) executing program 3: r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_rx_ring(r0, 0x107, 0x5, &(0x7f0000001100)=@req3={0x8000, 0x200, 0x80, 0x20000}, 0x1c) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r1}, 0x10) mmap(&(0x7f0000568000/0x2000)=nil, 0x1000000, 0x0, 0x11, r0, 0x0) executing program 0: unshare(0x22020400) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(aes-aesni)\x00'}, 0x58) r1 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r1, @ANYBLOB="0000000004000000b703000008000040850000006900000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f00000002c0)='sys_enter\x00', r2}, 0x10) accept4(r0, 0x0, 0x0, 0x0) executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000700)={0x1, @default, @bpq0, 0x2, 'syz0\x00', @null, 0x1, 0x1, [@null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @bcast, @default, @default]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash replaying the whole log did not cause a kernel crash single: executing 1 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000700)={0x1, @default, @bpq0, 0x2, 'syz0\x00', @null, 0x1, 0x1, [@null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @bcast, @default, @default]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program crashed: KASAN: slab-use-after-free Read in nr_rt_ioctl single: successfully extracted reproducer found reproducer with 12 syscalls minimizing guilty program testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$sock_netrom_SIOCADDRT detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000700)={0x1, @default, @bpq0, 0x2, 'syz0\x00', @null, 0x1, 0x1, [@null, @null, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @null, @bcast, @default, @default]}) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program crashed: WARNING: locking bug in __rmqueue_pcplist testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(0xffffffffffffffff, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, 0xffffffffffffffff, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r0, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(0xffffffffffffffff, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB, @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, 0x0, &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300), &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", 0x0, 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380), 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, 0x0, 0x0) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, 0x0) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, 0x0) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash extracting C reproducer testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS program crashed: no output from test machine a never seen crash title: no output from test machine, ignore simplifying guilty program options testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet_udp-syz_init_net_socket$netrom-bpf$MAP_CREATE-bpf$MAP_UPDATE_BATCH-socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-ioctl$sock_netrom_SIOCADDRT-ioctl$SIOCNRDECOBS detailed listing: executing program 0: socket$inet_udp(0x2, 0x2, 0x0) r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0100000004000000070000000700000000000000", @ANYRES32=0x1, @ANYBLOB='\x00'/14, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0500"/28], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, &(0x7f0000000180)=""/218, &(0x7f0000000300)="15b0f733fd6cffdf0edc23afde8ad0e687e173dfddaf40f93590d94a15b8593291f70c2847915d0762475f29e042259ecda4a4121812abb431e7aae152beecce40888818eeb273142fb1b5a56a58a905e1548b6b7de8370193f91b8cf45ae88a126a36155c", &(0x7f0000000380)="2ee97fded14678892c63d43a8db2bffde1b2d1d075b38c97a172bd7d1466f178a1c813374e82e9cd7ea888c49f5d6c23cab499b69393bd1cd35678101c0c483fa654ec4cbeb2430ac7c6515bda4f0c924e3597814ac4c0a67afd14d341", 0x5, r1, 0x4}, 0x38) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r3, 0x8914, &(0x7f0000000000)) ioctl$sock_netrom_SIOCADDRT(r0, 0x890b, &(0x7f0000000280)={0x1, @bcast, @rose={'rose', 0x0}, 0xffff, 'syz0\x00', @default, 0xfffffdba, 0x6, [@default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}]}) ioctl$SIOCNRDECOBS(r0, 0x89e2) program did not crash reproducing took 3h11m0.71216042s repro crashed as (corrupted=false): ============================= [ BUG: Invalid wait context ] 6.13.0-rc6-syzkaller-00036-gfbfd64d25c7a #0 Not tainted ----------------------------- sshd/5917 is trying to lock: ffff88807ffd8298 (&zone->lock){..-.}-{3:3}, at: rmqueue_bulk mm/page_alloc.c:2309 [inline] ffff88807ffd8298 (&zone->lock){..-.}-{3:3}, at: __rmqueue_pcplist+0x6bb/0x1600 mm/page_alloc.c:3003 other info that might help us debug this: context-{2:2} 5 locks held by sshd/5917: #0: ffff888025200148 (&vma->vm_lock->lock){++++}-{4:4}, at: vma_start_read include/linux/mm.h:717 [inline] #0: ffff888025200148 (&vma->vm_lock->lock){++++}-{4:4}, at: lock_vma_under_rcu+0x13e/0x980 mm/memory.c:6278 #1: ffffffff8e1bb900 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #1: ffffffff8e1bb900 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8e1bb900 (rcu_read_lock){....}-{1:3}, at: ___pte_offset_map+0x42/0x540 mm/pgtable-generic.c:287 #2: ffff88816da3c018 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] #2: ffff88816da3c018 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __pte_offset_map_lock+0xf1/0x300 mm/pgtable-generic.c:402 #3: ffff88806a83ebd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598 #4: ffff88806a844c58 (&pcp->lock){+.+.}-{3:3}, at: spin_trylock include/linux/spinlock.h:361 [inline] #4: ffff88806a844c58 (&pcp->lock){+.+.}-{3:3}, at: rmqueue_pcplist mm/page_alloc.c:3032 [inline] #4: ffff88806a844c58 (&pcp->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3076 [inline] #4: ffff88806a844c58 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x350/0x2f80 mm/page_alloc.c:3473 stack backtrace: CPU: 2 UID: 0 PID: 5917 Comm: sshd Not tainted 6.13.0-rc6-syzkaller-00036-gfbfd64d25c7a #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_lock_invalid_wait_context kernel/locking/lockdep.c:4826 [inline] check_wait_context kernel/locking/lockdep.c:4898 [inline] __lock_acquire+0x878/0x3c40 kernel/locking/lockdep.c:5176 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 rmqueue_bulk mm/page_alloc.c:2309 [inline] __rmqueue_pcplist+0x6bb/0x1600 mm/page_alloc.c:3003 rmqueue_pcplist mm/page_alloc.c:3045 [inline] rmqueue mm/page_alloc.c:3076 [inline] get_page_from_freelist+0x3d2/0x2f80 mm/page_alloc.c:3473 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269 stack_depot_save_flags+0x8aa/0x9c0 lib/stackdepot.c:627 save_stack+0x16f/0x1f0 mm/page_owner.c:157 __set_page_owner+0x8b/0x560 mm/page_owner.c:320 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3476 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269 stack_depot_save_flags+0x8aa/0x9c0 lib/stackdepot.c:627 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:544 task_work_add+0xc0/0x3b0 kernel/task_work.c:77 task_tick_numa kernel/sched/fair.c:3616 [inline] task_tick_fair+0x524/0x8e0 kernel/sched/fair.c:13101 sched_tick+0x1dd/0x4f0 kernel/sched/core.c:5652 update_process_times+0x19c/0x2d0 kernel/time/timer.c:2524 tick_sched_handle kernel/time/tick-sched.c:276 [inline] tick_nohz_handler+0x376/0x530 kernel/time/tick-sched.c:297 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x5fb/0xae0 kernel/time/hrtimer.c:1803 hrtimer_interrupt+0x392/0x8e0 kernel/time/hrtimer.c:1865 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline] __sysvec_apic_timer_interrupt+0x10f/0x400 arch/x86/kernel/apic/apic.c:1055 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:folio_nr_pages include/linux/mm.h:2059 [inline] RIP: 0010:folio_add_new_anon_rmap+0x5e/0x1980 mm/rmap.c:1429 Code: c5 48 89 c7 e8 13 64 12 00 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 31 16 00 00 4d 8b 6d 00 31 ff <41> bf 01 00 00 00 49 c1 ed 06 41 83 e5 01 44 89 ee e8 dc b3 af ff RSP: 0000:ffffc90003e3fbc0 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffffea0000db95c0 RCX: ffffffff81ea5f5d RDX: 1ffffd40001b72b8 RSI: 0000000000000008 RDI: 0000000000000000 RBP: ffff888028016c98 R08: 0000000000000000 R09: fffff940001b72b8 R10: ffffea0000db95c7 R11: 0000000000000002 R12: 00007faadc7c5000 R13: 00fff00000000008 R14: 0000000000000001 R15: 0000000000000000 do_anonymous_page mm/memory.c:4855 [inline] do_pte_missing+0x2a89/0x3e00 mm/memory.c:3977 handle_pte_fault mm/memory.c:5801 [inline] __handle_mm_fault+0x103c/0x2a40 mm/memory.c:5944 handle_mm_fault+0x3fa/0xaa0 mm/memory.c:6112 do_user_addr_fault+0x60d/0x13f0 arch/x86/mm/fault.c:1338 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x55f827b5d823 Code: 4c 89 ed 4c 89 e7 f3 aa eb 48 4c 89 e7 e8 95 48 f7 ff 48 89 c5 48 85 c0 74 38 48 89 c7 4c 89 ee 4d 39 f4 76 11 4c 89 f1 31 c0 a4 4c 89 e1 4c 29 f1 f3 aa eb 05 4c 89 e1 f3 a4 4c 89 ef 48 83 RSP: 002b:00007ffe868ccb20 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000340000 RCX: 0000000000085e10 RDX: 0000000000000002 RSI: 00007faadc15f000 RDI: 00007faadc7c5000 RBP: 00007faadc50e010 R08: 00007faadc50e010 R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000340000 R13: 00007faadbea8010 R14: 000000000033ce00 R15: 00007ffe868cccd8 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 48 89 c7 mov %rax,%rdi 3: e8 13 64 12 00 call 0x12641b 8: 4c 89 ea mov %r13,%rdx b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 12: fc ff df 15: 48 c1 ea 03 shr $0x3,%rdx 19: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 1d: 0f 85 31 16 00 00 jne 0x1654 23: 4d 8b 6d 00 mov 0x0(%r13),%r13 27: 31 ff xor %edi,%edi * 29: 41 bf 01 00 00 00 mov $0x1,%r15d <-- trapping instruction 2f: 49 c1 ed 06 shr $0x6,%r13 33: 41 83 e5 01 and $0x1,%r13d 37: 44 89 ee mov %r13d,%esi 3a: e8 dc b3 af ff call 0xffafb41b final repro crashed as (corrupted=false): ============================= [ BUG: Invalid wait context ] 6.13.0-rc6-syzkaller-00036-gfbfd64d25c7a #0 Not tainted ----------------------------- sshd/5917 is trying to lock: ffff88807ffd8298 (&zone->lock){..-.}-{3:3}, at: rmqueue_bulk mm/page_alloc.c:2309 [inline] ffff88807ffd8298 (&zone->lock){..-.}-{3:3}, at: __rmqueue_pcplist+0x6bb/0x1600 mm/page_alloc.c:3003 other info that might help us debug this: context-{2:2} 5 locks held by sshd/5917: #0: ffff888025200148 (&vma->vm_lock->lock){++++}-{4:4}, at: vma_start_read include/linux/mm.h:717 [inline] #0: ffff888025200148 (&vma->vm_lock->lock){++++}-{4:4}, at: lock_vma_under_rcu+0x13e/0x980 mm/memory.c:6278 #1: ffffffff8e1bb900 (rcu_read_lock){....}-{1:3}, at: rcu_lock_acquire include/linux/rcupdate.h:337 [inline] #1: ffffffff8e1bb900 (rcu_read_lock){....}-{1:3}, at: rcu_read_lock include/linux/rcupdate.h:849 [inline] #1: ffffffff8e1bb900 (rcu_read_lock){....}-{1:3}, at: ___pte_offset_map+0x42/0x540 mm/pgtable-generic.c:287 #2: ffff88816da3c018 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: spin_lock include/linux/spinlock.h:351 [inline] #2: ffff88816da3c018 (ptlock_ptr(ptdesc)#2){+.+.}-{3:3}, at: __pte_offset_map_lock+0xf1/0x300 mm/pgtable-generic.c:402 #3: ffff88806a83ebd8 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x29/0x130 kernel/sched/core.c:598 #4: ffff88806a844c58 (&pcp->lock){+.+.}-{3:3}, at: spin_trylock include/linux/spinlock.h:361 [inline] #4: ffff88806a844c58 (&pcp->lock){+.+.}-{3:3}, at: rmqueue_pcplist mm/page_alloc.c:3032 [inline] #4: ffff88806a844c58 (&pcp->lock){+.+.}-{3:3}, at: rmqueue mm/page_alloc.c:3076 [inline] #4: ffff88806a844c58 (&pcp->lock){+.+.}-{3:3}, at: get_page_from_freelist+0x350/0x2f80 mm/page_alloc.c:3473 stack backtrace: CPU: 2 UID: 0 PID: 5917 Comm: sshd Not tainted 6.13.0-rc6-syzkaller-00036-gfbfd64d25c7a #0 Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x116/0x1f0 lib/dump_stack.c:120 print_lock_invalid_wait_context kernel/locking/lockdep.c:4826 [inline] check_wait_context kernel/locking/lockdep.c:4898 [inline] __lock_acquire+0x878/0x3c40 kernel/locking/lockdep.c:5176 lock_acquire.part.0+0x11b/0x380 kernel/locking/lockdep.c:5849 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline] _raw_spin_lock_irqsave+0x3a/0x60 kernel/locking/spinlock.c:162 rmqueue_bulk mm/page_alloc.c:2309 [inline] __rmqueue_pcplist+0x6bb/0x1600 mm/page_alloc.c:3003 rmqueue_pcplist mm/page_alloc.c:3045 [inline] rmqueue mm/page_alloc.c:3076 [inline] get_page_from_freelist+0x3d2/0x2f80 mm/page_alloc.c:3473 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269 stack_depot_save_flags+0x8aa/0x9c0 lib/stackdepot.c:627 save_stack+0x16f/0x1f0 mm/page_owner.c:157 __set_page_owner+0x8b/0x560 mm/page_owner.c:320 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x2d1/0x350 mm/page_alloc.c:1558 prep_new_page mm/page_alloc.c:1566 [inline] get_page_from_freelist+0xfce/0x2f80 mm/page_alloc.c:3476 __alloc_pages_noprof+0x223/0x25b0 mm/page_alloc.c:4753 alloc_pages_mpol_noprof+0x2c9/0x610 mm/mempolicy.c:2269 stack_depot_save_flags+0x8aa/0x9c0 lib/stackdepot.c:627 kasan_save_stack+0x42/0x60 mm/kasan/common.c:48 __kasan_record_aux_stack+0xba/0xd0 mm/kasan/generic.c:544 task_work_add+0xc0/0x3b0 kernel/task_work.c:77 task_tick_numa kernel/sched/fair.c:3616 [inline] task_tick_fair+0x524/0x8e0 kernel/sched/fair.c:13101 sched_tick+0x1dd/0x4f0 kernel/sched/core.c:5652 update_process_times+0x19c/0x2d0 kernel/time/timer.c:2524 tick_sched_handle kernel/time/tick-sched.c:276 [inline] tick_nohz_handler+0x376/0x530 kernel/time/tick-sched.c:297 __run_hrtimer kernel/time/hrtimer.c:1739 [inline] __hrtimer_run_queues+0x5fb/0xae0 kernel/time/hrtimer.c:1803 hrtimer_interrupt+0x392/0x8e0 kernel/time/hrtimer.c:1865 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline] __sysvec_apic_timer_interrupt+0x10f/0x400 arch/x86/kernel/apic/apic.c:1055 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline] sysvec_apic_timer_interrupt+0x9f/0xc0 arch/x86/kernel/apic/apic.c:1049 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702 RIP: 0010:folio_nr_pages include/linux/mm.h:2059 [inline] RIP: 0010:folio_add_new_anon_rmap+0x5e/0x1980 mm/rmap.c:1429 Code: c5 48 89 c7 e8 13 64 12 00 4c 89 ea 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 80 3c 02 00 0f 85 31 16 00 00 4d 8b 6d 00 31 ff <41> bf 01 00 00 00 49 c1 ed 06 41 83 e5 01 44 89 ee e8 dc b3 af ff RSP: 0000:ffffc90003e3fbc0 EFLAGS: 00000246 RAX: dffffc0000000000 RBX: ffffea0000db95c0 RCX: ffffffff81ea5f5d RDX: 1ffffd40001b72b8 RSI: 0000000000000008 RDI: 0000000000000000 RBP: ffff888028016c98 R08: 0000000000000000 R09: fffff940001b72b8 R10: ffffea0000db95c7 R11: 0000000000000002 R12: 00007faadc7c5000 R13: 00fff00000000008 R14: 0000000000000001 R15: 0000000000000000 do_anonymous_page mm/memory.c:4855 [inline] do_pte_missing+0x2a89/0x3e00 mm/memory.c:3977 handle_pte_fault mm/memory.c:5801 [inline] __handle_mm_fault+0x103c/0x2a40 mm/memory.c:5944 handle_mm_fault+0x3fa/0xaa0 mm/memory.c:6112 do_user_addr_fault+0x60d/0x13f0 arch/x86/mm/fault.c:1338 handle_page_fault arch/x86/mm/fault.c:1481 [inline] exc_page_fault+0x5c/0xc0 arch/x86/mm/fault.c:1539 asm_exc_page_fault+0x26/0x30 arch/x86/include/asm/idtentry.h:623 RIP: 0033:0x55f827b5d823 Code: 4c 89 ed 4c 89 e7 f3 aa eb 48 4c 89 e7 e8 95 48 f7 ff 48 89 c5 48 85 c0 74 38 48 89 c7 4c 89 ee 4d 39 f4 76 11 4c 89 f1 31 c0 a4 4c 89 e1 4c 29 f1 f3 aa eb 05 4c 89 e1 f3 a4 4c 89 ef 48 83 RSP: 002b:00007ffe868ccb20 EFLAGS: 00010246 RAX: 0000000000000000 RBX: 0000000000340000 RCX: 0000000000085e10 RDX: 0000000000000002 RSI: 00007faadc15f000 RDI: 00007faadc7c5000 RBP: 00007faadc50e010 R08: 00007faadc50e010 R09: 0000000000000000 R10: 0000000000000022 R11: 0000000000000246 R12: 0000000000340000 R13: 00007faadbea8010 R14: 000000000033ce00 R15: 00007ffe868cccd8 ---------------- Code disassembly (best guess), 1 bytes skipped: 0: 48 89 c7 mov %rax,%rdi 3: e8 13 64 12 00 call 0x12641b 8: 4c 89 ea mov %r13,%rdx b: 48 b8 00 00 00 00 00 movabs $0xdffffc0000000000,%rax 12: fc ff df 15: 48 c1 ea 03 shr $0x3,%rdx 19: 80 3c 02 00 cmpb $0x0,(%rdx,%rax,1) 1d: 0f 85 31 16 00 00 jne 0x1654 23: 4d 8b 6d 00 mov 0x0(%r13),%r13 27: 31 ff xor %edi,%edi * 29: 41 bf 01 00 00 00 mov $0x1,%r15d <-- trapping instruction 2f: 49 c1 ed 06 shr $0x6,%r13 33: 41 83 e5 01 and $0x1,%r13d 37: 44 89 ee mov %r13d,%esi 3a: e8 dc b3 af ff call 0xffafb41b