Extracting prog: 2h15m58.147003523s Minimizing prog: 20m20.101627394s Simplifying prog options: 0s Extracting C: 1m50.047882687s Simplifying C: 21m38.761869131s extracting reproducer from 30 programs first checking the prog from the crash report single: executing 1 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_sco-socketpair$unix-syz_init_net_socket$ax25-bind$ax25-socket$pppl2tp-socket$inet6_udp-connect$pppl2tp-close-setsockopt$inet6_IPV6_XFRM_POLICY-socket$pppl2tp-connect$pppl2tp-ioctl$PPPIOCGL2TPSTATS-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netrom_SIOCADDRT-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-socket$inet-socket$inet_tcp-setsockopt$inet_opts-ioctl$sock_SIOCGIFINDEX-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$kcm detailed listing: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 15, 2, 29, 6, 8, 6, 29, 7, 9, 5, 7, 8, 5, 9, 10, 3, 6, 2, 12, 4, 7, 6, 7, 8, 8, 29, 26, 15, 28] detailed listing: executing program 1: r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000002c0)='contention_begin\x00', r0, 0x0, 0xd}, 0x18) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000080)='hugetlb.2MB.limit_in_bytes\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000180)=ANY=[], 0x27) executing program 1: sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000001, 0x59033, 0xffffffffffffffff, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) executing program 1: r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x8, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000100000000001000000b7080000000000007baaf8ff00000000b5080000000000197b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000001000000b70500000800000085000000690000009500000000000000"], &(0x7f0000000300)='GPL\x00', 0x3, 0xc, &(0x7f0000001e00)=""/4087}, 0x90) executing program 1: r0 = socket$unix(0x1, 0x5, 0x0) bind$unix(r0, &(0x7f0000003000)=@abs={0x1, 0x0, 0xffffffff}, 0x6e) bind$unix(r0, &(0x7f0000003000)=@abs={0x1}, 0x6e) r1 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f0000000280)={@mcast2, 0x2, 0x1, 0x2, 0xa, 0xc53e, 0x8}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000140)={0x3, 0x1, &(0x7f00000003c0)=ANY=[@ANYBLOB], &(0x7f0000000980)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls=0x36, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000b80)=@mangle={'mangle\x00', 0x10, 0x6, 0x508, 0x368, 0x368, 0x1a0, 0xd0, 0x368, 0x438, 0x438, 0x438, 0x438, 0x438, 0x6, 0x0, {[{{@ipv6={@private2, @private1, [0xffffffff, 0xffffff00, 0x0, 0xff], [0xffffff, 0xffffffff, 0xffffffff, 0xffffffff], 'veth1_macvtap\x00', 'ip6_vti0\x00', {}, {0xff}, 0x5e, 0x6e, 0x3}, 0x0, 0xa8, 0xd0, 0x0, {0x7a00000000000000}}, @HL={0x28}}, {{@ipv6={@loopback, @loopback, [0x0, 0x0, 0xff000000], [0x0, 0x0, 0xffffffff], 'lo\x00', 'dvmrp0\x00', {0xff}}, 0x0, 0xa8, 0xd0}, @HL={0x28, 'HL\x00', 0x0, {0x1, 0x2}}}, {{@ipv6={@loopback, @local, [0x0, 0xffffffff, 0xff000000, 0xffffffff], [0x0, 0x7fffff00, 0xffffff00, 0xffffffff], 'vxcan1\x00', 'veth0_macvtap\x00', {}, {}, 0x2b, 0x0, 0x3, 0x13}, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@common=@ipv6header={{0x28}, {0x18, 0x81, 0x1}}]}, @inet=@TOS={0x28, 'TOS\x00', 0x0, {0x3, 0x9}}}, {{@uncond, 0x0, 0xa8, 0xd0}, @unspec=@CHECKSUM={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x568) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000300), 0xffffffffffffffff) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) connect$unix(r4, &(0x7f0000000100)=@abs={0x27}, 0x6e) sendmsg$NL80211_CMD_GET_REG(r0, &(0x7f00000006c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000340)={&(0x7f0000000500)=ANY=[@ANYBLOB="a4010084", @ANYRES16=r3, @ANYBLOB="08002dbd7000fddbdf251f000000980022802c000080080005000100000008000700410000000800040006000000080004000700000008000600000200005400008008000700010000000800040006000000080004000000803f0800030005000000080002000d00000008000500060000000800030001000000080003000900000008000700090000000800030002000000140000800800030003000000080007000f000000f0002280140000800800070000000000080002007fffffff1c000080080006008000000008000400ff03000008000500070000003400008008000600ffffffff080001000900000008000600020000000800010000000000080005000900000008000100030000001c000080080003000000000008000200fbffffff0800040001000000440000800800030001000000080002000000004008000200800000000800040035bf000008000500000800000800050003000000080004000dfec91608000500ce0000001400008008000200000080000800010000000000140000800800030004000000080004002005000008009a0001"], 0x1a4}, 0x1, 0x0, 0x0, 0x20040005}, 0x8800) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_TABLE(r6, 0x29, 0xd1, &(0x7f0000000040)=0xfe, 0x4) r7 = socket$packet(0x11, 0x2, 0x300) syz_init_net_socket$netrom(0x6, 0x5, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000002140)={@map, 0xffffffffffffffff, 0x1, 0x2014}, 0x20) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000240)={'syz_tun\x00', 0x0}) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r5) sendmsg$ETHTOOL_MSG_DEBUG_GET(r5, &(0x7f00000008c0)={0x0, 0x0, &(0x7f0000000880)={&(0x7f0000000400)=ANY=[@ANYRES16=r9, @ANYBLOB="01002abd7000fedbdf25070000000c00018008000100", @ANYRES32=r8, @ANYBLOB="da701977181914b5c7db6cd9a2a45dc2e4e8b6e206faa0672f0591a6db744f0c9870208ee4771ef5cf2a8d14a5d13de77785a48d65bfaf4e435e84c91973169922e3015ae51fefee6dad978e8e94c2cfbdaa82ad7770bd9689c57a338679800000000000000000000000000000d49580ac65fc0d47205bbfdcc92a32c19ffc474513d5f698405e31af786f06be8689143e80a4078d34d6e146972346b4c9130636da1c87e2382cd272959a8bebdd3fbffbecfd5b2c96521c8c6b0c75a0c7a6"], 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x8000) r10 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), r10) sendmsg$nl_generic(r10, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={0x20, 0x10, 0x701, 0x0, 0x0, {0xa}, [@typed={0xc, 0x2, 0x0, 0x0, @str='nl80211\x00'}]}, 0x20}}, 0x0) r11 = socket$nl_xfrm(0x10, 0x3, 0x6) getsockname(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCETHTOOL(r11, 0x8946, &(0x7f00000003c0)={'macvtap0\x00', &(0x7f0000000380)=@ethtool_eee={0x45, 0x10001, 0x10001, 0x7ff, 0xfffffff4, 0x6bf, 0x3, 0x9f, [0x4, 0x8]}}) r12 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_HARDIF(r5, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x4c, r12, 0x300, 0x70bd2b, 0x25dfdbff, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}, @BATADV_ATTR_HOP_PENALTY={0x5, 0x35, 0x8}, @BATADV_ATTR_GW_BANDWIDTH_UP={0x8, 0x32, 0x1}, @BATADV_ATTR_MULTICAST_FANOUT={0x8, 0x3c, 0x9}]}, 0x4c}, 0x1, 0x0, 0x0, 0x24000084}, 0x40000) executing program 1: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r1, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f00000000c0)=[{0x6}]}, 0x10) sendmmsg(r0, &(0x7f0000000180), 0x4000190, 0x3e80) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x5, 0x5, 0x8, 0xc}, 0x50) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006d00000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r3}, 0x10) executing program 1: r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x60, 0x0) ioctl$TIOCSETD(r0, 0x5423, &(0x7f00000000c0)=0xf) ioctl$TCFLSH(r0, 0x400455c8, 0x1) ioctl$TIOCVHANGUP(r0, 0x5437, 0x0) syz_usb_connect(0x1, 0xfffffffffffffde4, 0x0, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000140)={0x1f, 0xffff, 0x2}, 0x6) executing program 2: r0 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r0, 0x0, 0x23, &(0x7f0000000100)={@multicast2, @loopback}, 0xc) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$netlink(0x10, 0x3, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) close(0x3) executing program 2: socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6(0xa, 0x4, 0x7) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x240008c1}, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, 0x0, 0x0) bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x7fff, @loopback}, 0x1c) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r3, 0x1, 0x8, &(0x7f0000000000)=0x80, 0x4) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000180)=0x800, 0x4) r4 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000300)={0x34, r4, 0x1, 0x0, 0x25dfdbfb, {0x25}, [@handle=@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x41}, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f0000000000), 0xffffffffffffffff) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001a00010000000000000080000a"], 0x1c}}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$key(0xffffffffffffffff, 0x0, 0x810) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x11, 0xc, &(0x7f0000000380)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020786c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000ffffffff8500000010000000850000002a00000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) sendmsg$NL80211_CMD_TRIGGER_SCAN(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001440)={0x1c, r8, 0x1, 0x0, 0x0, {{0x8}, {@val={0x8, 0x3, r7}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) executing program 2: r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000380)={0xa, 0x14e24}, 0x1c) connect$inet6(r0, &(0x7f00000002c0)={0xa, 0x4e24}, 0x1c) recvmsg(r0, &(0x7f0000000340)={&(0x7f0000000740), 0x80, &(0x7f0000000f80)=[{&(0x7f0000001c00)=""/168, 0xa8}, {0x0}], 0x2}, 0x40000020) sendmmsg$inet6(r0, &(0x7f0000005540)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000400)="c0e4bd", 0x3}], 0x1}}], 0x1, 0xc8040) sendmmsg(r0, &(0x7f00000092c0), 0x4ff, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) executing program 2: mmap(&(0x7f000009e000/0x4000)=nil, 0x4000, 0x0, 0x28011, 0xffffffffffffffff, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) syz_init_net_socket$llc(0x1a, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.events\x00', 0x26e1, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) sendmsg$NLBL_CIPSOV4_C_ADD(0xffffffffffffffff, 0x0, 0x4) write$cgroup_int(r0, &(0x7f0000000200), 0x806000) ioctl$FS_IOC_RESVSP(r0, 0x40305829, &(0x7f0000000380)={0x0, 0x2, 0xfffffffffffffff9, 0xac}) executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) recvmmsg(r0, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)=""/27, 0x1b}], 0x1}, 0x7}], 0x1, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd010000000000140000006000000000280600fe88a43de1a400000000000000027d01ff020000000000000000000000000001000088bed2868a1610e8f515ab"], 0xfdef) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x20000884}, 0x0) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400000010000100000000000072a30754a77d8b3b000000000a01010000000000000000010000000900010073797a30000000003c000000090a0104000000000000010000000c00fc53e999a94c0c54e60000000900020073797a32000000000900010073797a3000000000081d"], 0xd0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) socket$kcm(0xa, 0x3, 0x3a) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fd1ff7907001175f37538e486dd6317010000213a00db536873f45f08c6feaa70e2aef57b20000000000000000000000000ac1414aa"], 0xfdef) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xd26, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000013000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010000c800c0022"], 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x0) executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002ec0)=@newtfilter={0x4a4, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x470, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0x6}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x5}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x444, 0x2, [@m_sample={0x128, 0x9, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xfffffff7}]}, {0xf1, 0x6, "7de1d3790d9a29295dd21381068e514fa961e7905c3b7c4f6aa13057b12de84e77e664d1fa3e75eabd2798245d143eae9fa95bbc680a1c92f121822d45d02c8ad526cb383d828231fd917807ef1146ba220f3e43f539d1cb172eb84a2323f79290e28762509ca98acc80f1b6eeeac9604cb98935b7af52867208021f74dcc420fa4626adfb4671f005c9a9860ce0d9c0d636a240267fc68c53ccc49a01e9c0667766baf716128c8a339f316bd5e18563d313628cce81bcc71d575033e7e79a3649234dda5718c6eac0aa89d834101c6e3678ac0153aee7916533daf05c22e6b94ca01bc88011300a3bb258f536"}, {0xc}, {0xc}}}, @m_vlan={0x170, 0xd, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0xce, 0x3, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x4, 0x2}, 0x1}}]}, {0x102, 0x6, "194876e71e2c22f2601f26c3ddf32908021d65c9b3366c4b6264a30b78bbb979c687b9627b4a8c2e408a4b9e075182c3a72e51856f03c86cd2e3fb9c9f1ec05d119bf8bf5f10eb27f8b1f6d8c25a59932d2a29f2aa878b27368e14390c7f9d92438e8fc05c2d34ef3be36dfc0203f5823c3d1ef2457caca6a0b53b598671689892b30e32c203af2ff05f3440b6b649dd600e35c260b8b4937e9be221e2e956d3fde4c98f9e18f9dec32b9d3e6ca74f9fd508afd127655158115d915b0f74d3b05b948143c5fb1cd11b0bc2e687294d242165ed45eaf09cc9efffc4fd6aede42c33b879c549b63a734d0da8e25d51f3d4767ea877bc3cd6a1653acf4ab66f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_csum={0x1a8, 0x17, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x4, 0x7, 0x2, 0x101}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x80000000, 0x5, 0x31, 0x5}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0xc8, 0x8, 0x1c6d, 0x7}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x68b3, 0x3, 0x8, 0x4, 0x8}, 0x66}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x10000000, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfcc, 0xffffffff, 0x0, 0x0, 0x3}, 0x3f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x100, 0x7, 0x6, 0x27, 0x80000001}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0xfffffffa, 0xffffffffffffffff, 0x2, 0x3}}}]}, {0x9b, 0x6, "deb2e1945b3ffe5b487b09e9c26ae18230f29852d3ffad815db92cd3fd76c15b4ec8829ec0f04a81bdf393abb8183a27493533dabab9a6d17893e5aa3ec826c0ca0b4e00c14a2ffd69cc49d8bb8e74128c8ae722483f47ef8cc2b38babab2d7ea7163b6a3807da981f67f2688fb1906d9ff51f33df7f33bfe1056c855b2056f5b8e460e9b12a762363d6d604b92190a24787cf4c06c8bd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='yeah\x00', 0x5) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@window, @window={0x3, 0x2, 0x1}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @sack_perm, @timestamp, @mss={0x2, 0x1}, @sack_perm], 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@ipv6_newrule={0x1c, 0x20, 0x1, 0x0, 0x0, {0xa, 0x20, 0x20}}, 0x1c}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)="3ce2de4d8d957a8de4e490b6cd03b988d4edef164bd3377aa381b5f50b7ca414516489f78cd7208982e9bde22b2b7c1c7606d565477f3db9d2b077283644c0f27ab52a863a42863e06944e40a0b3c5d21c8cbe102e7f726263f28aef1bc12a069063d4c30e8f329fdb36859be727fbef4314161e5fb5f01ae00a2634d5cdecca2089c62e32f4c919886b2b88d237e287318739bec0364caf15889f38a312ef6621c0f21709a4bf2b16274cf933f6ad8fcc9c2024bc1b4713f650e860f93ae93b2361956b3e80c38c5fd29b5c1b5d7ce67edc856a8dc0ba54cee53de9a48c131389426bd06ec7c695add357934fc0321f0d3d7982e4fe5a0039decc491a663afd02facb08dd9695f854c7b031d9af8bd7350897996b5208b23030cc0feb84570730eaf24b9f2ac05d0feb3be07a29f887095f36f3c8f0e77e45509acd14a5be4a1572dd4cd1231087b830fa03e071571d4abd694710ef140469cf6df8a59839aafe046a5bffb97e5247be901789eafd726ba090337a2c49207e6b900c7e982472e6aac70e5d52ca2c1bab47b1f6d00f9601e2281686c21f770ae96e0ffec4b30496d012fa00958f794cdbd721bd155cae87", 0x109e8, 0x805, 0x0, 0x6) executing program 4: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f00000000c0)=0xabb3, 0x4) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x60000000}, 0x4000000) executing program 4: sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc008}, 0x4008010) r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000440)={0xb0000010}) executing program 3: r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x328, 0x118, 0x168, 0x9, 0x118, 0xb, 0x258, 0x250, 0x250, 0x258, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0xd0, 0x118, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xd}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 'gretap0\x00', {0x8}}}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@inet=@set3={{0x50}, {{0x4, 0x1}, {0x7, 0xe}, {0x7, 0x5}, 0xfff}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@local, 'batadv0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x388) executing program 3: socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$netlbl_calipso(0x0, 0xffffffffffffffff) r0 = socket$inet(0xa, 0x801, 0x84) listen(r0, 0xfffffffd) listen(0xffffffffffffffff, 0x8) listen(0xffffffffffffffff, 0x8) r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0x8) listen(0xffffffffffffffff, 0x1) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, 0x0, 0x20004005) executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x40, 0x5d, 0x2, 0x190b87f7}, {0x6, 0x0, 0x6, 0x1}]}, 0x10) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000140)="24000000010006", 0x7) executing program 3: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80"], 0xa8}}, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r0, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0xc8}, 0x2}, 0x0) executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x81}, 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmmsg(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f00000011c0), 0x2}}], 0x3ffffffffffff49, 0x404c840) unshare(0x600) ppoll(&(0x7f0000005240)=[{0xffffffffffffffff, 0x2}, {0xffffffffffffffff, 0x100}, {0xffffffffffffffff, 0x2}], 0x4c, &(0x7f0000005280)={0x77359400}, &(0x7f00000052c0)={[0x7]}, 0x8) executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, 0x0, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x1000d, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fffffff}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r1, 0x8b2a, &(0x7f0000000040)) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000002c00), 0x0, 0x20, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000a80)=ANY=[@ANYBLOB="0180c200000e0000000000008100200086dd63269fe000243aff20010000000000000000000000000001ff020000000000000000000000000021a4cb241ff60b366c24012c00000000000000000100000000000087009078ff0200000000000000000000000000018629d7fd43d30666ecfb3a17b06ae81dde31b3d6429a8a20dd9e9f"], 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 4: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000680)) r1 = socket(0xb, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet(0xa, 0x801, 0x84) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r7, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x5, 0x4, 0x1, 0x1, 0x14, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}}}}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x390, 0x1d0, 0x5802, 0x294, 0x0, 0x294, 0x310, 0x378, 0x378, 0x310, 0x378, 0x3, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, [0xffffff00, 0xff, 0xff000000, 0xff000000], [0xff, 0xff, 0xff, 0xff000000], 'veth0_to_hsr\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x0, 0x2, 0x80}, 0x0, 0xa8, 0x1d0, 0x52020000}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xe5f6, 'system_u:object_r:etc_aliases_t:s0\x00'}}}, {{@ipv6={@loopback, @remote, [], [0x0, 0x0, 0x0, 0xffffffff], 'ip6erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x81}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x1, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000000)=ANY=[@ANYBLOB='fi'], &(0x7f0000000100)=0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r5, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, 0x0, 0x0) executing program 0: sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000001, 0x59033, 0xffffffffffffffff, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release bisect: bisecting 30 programs bisect: split chunks (needed=false): <29> bisect: split chunk #0 of len 29 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 7, 8, 5, 9, 10, 3, 6, 2, 12, 4, 7, 6, 7, 8, 8, 29, 26, 15, 28] detailed listing: executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) recvmmsg(r0, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)=""/27, 0x1b}], 0x1}, 0x7}], 0x1, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd010000000000140000006000000000280600fe88a43de1a400000000000000027d01ff020000000000000000000000000001000088bed2868a1610e8f515ab"], 0xfdef) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x20000884}, 0x0) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400000010000100000000000072a30754a77d8b3b000000000a01010000000000000000010000000900010073797a30000000003c000000090a0104000000000000010000000c00fc53e999a94c0c54e60000000900020073797a32000000000900010073797a3000000000081d"], 0xd0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) socket$kcm(0xa, 0x3, 0x3a) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fd1ff7907001175f37538e486dd6317010000213a00db536873f45f08c6feaa70e2aef57b20000000000000000000000000ac1414aa"], 0xfdef) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xd26, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000013000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010000c800c0022"], 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x0) executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002ec0)=@newtfilter={0x4a4, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x470, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0x6}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x5}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x444, 0x2, [@m_sample={0x128, 0x9, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xfffffff7}]}, {0xf1, 0x6, "7de1d3790d9a29295dd21381068e514fa961e7905c3b7c4f6aa13057b12de84e77e664d1fa3e75eabd2798245d143eae9fa95bbc680a1c92f121822d45d02c8ad526cb383d828231fd917807ef1146ba220f3e43f539d1cb172eb84a2323f79290e28762509ca98acc80f1b6eeeac9604cb98935b7af52867208021f74dcc420fa4626adfb4671f005c9a9860ce0d9c0d636a240267fc68c53ccc49a01e9c0667766baf716128c8a339f316bd5e18563d313628cce81bcc71d575033e7e79a3649234dda5718c6eac0aa89d834101c6e3678ac0153aee7916533daf05c22e6b94ca01bc88011300a3bb258f536"}, {0xc}, {0xc}}}, @m_vlan={0x170, 0xd, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0xce, 0x3, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x4, 0x2}, 0x1}}]}, {0x102, 0x6, "194876e71e2c22f2601f26c3ddf32908021d65c9b3366c4b6264a30b78bbb979c687b9627b4a8c2e408a4b9e075182c3a72e51856f03c86cd2e3fb9c9f1ec05d119bf8bf5f10eb27f8b1f6d8c25a59932d2a29f2aa878b27368e14390c7f9d92438e8fc05c2d34ef3be36dfc0203f5823c3d1ef2457caca6a0b53b598671689892b30e32c203af2ff05f3440b6b649dd600e35c260b8b4937e9be221e2e956d3fde4c98f9e18f9dec32b9d3e6ca74f9fd508afd127655158115d915b0f74d3b05b948143c5fb1cd11b0bc2e687294d242165ed45eaf09cc9efffc4fd6aede42c33b879c549b63a734d0da8e25d51f3d4767ea877bc3cd6a1653acf4ab66f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_csum={0x1a8, 0x17, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x4, 0x7, 0x2, 0x101}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x80000000, 0x5, 0x31, 0x5}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0xc8, 0x8, 0x1c6d, 0x7}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x68b3, 0x3, 0x8, 0x4, 0x8}, 0x66}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x10000000, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfcc, 0xffffffff, 0x0, 0x0, 0x3}, 0x3f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x100, 0x7, 0x6, 0x27, 0x80000001}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0xfffffffa, 0xffffffffffffffff, 0x2, 0x3}}}]}, {0x9b, 0x6, "deb2e1945b3ffe5b487b09e9c26ae18230f29852d3ffad815db92cd3fd76c15b4ec8829ec0f04a81bdf393abb8183a27493533dabab9a6d17893e5aa3ec826c0ca0b4e00c14a2ffd69cc49d8bb8e74128c8ae722483f47ef8cc2b38babab2d7ea7163b6a3807da981f67f2688fb1906d9ff51f33df7f33bfe1056c855b2056f5b8e460e9b12a762363d6d604b92190a24787cf4c06c8bd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='yeah\x00', 0x5) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@window, @window={0x3, 0x2, 0x1}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @sack_perm, @timestamp, @mss={0x2, 0x1}, @sack_perm], 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@ipv6_newrule={0x1c, 0x20, 0x1, 0x0, 0x0, {0xa, 0x20, 0x20}}, 0x1c}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)="3ce2de4d8d957a8de4e490b6cd03b988d4edef164bd3377aa381b5f50b7ca414516489f78cd7208982e9bde22b2b7c1c7606d565477f3db9d2b077283644c0f27ab52a863a42863e06944e40a0b3c5d21c8cbe102e7f726263f28aef1bc12a069063d4c30e8f329fdb36859be727fbef4314161e5fb5f01ae00a2634d5cdecca2089c62e32f4c919886b2b88d237e287318739bec0364caf15889f38a312ef6621c0f21709a4bf2b16274cf933f6ad8fcc9c2024bc1b4713f650e860f93ae93b2361956b3e80c38c5fd29b5c1b5d7ce67edc856a8dc0ba54cee53de9a48c131389426bd06ec7c695add357934fc0321f0d3d7982e4fe5a0039decc491a663afd02facb08dd9695f854c7b031d9af8bd7350897996b5208b23030cc0feb84570730eaf24b9f2ac05d0feb3be07a29f887095f36f3c8f0e77e45509acd14a5be4a1572dd4cd1231087b830fa03e071571d4abd694710ef140469cf6df8a59839aafe046a5bffb97e5247be901789eafd726ba090337a2c49207e6b900c7e982472e6aac70e5d52ca2c1bab47b1f6d00f9601e2281686c21f770ae96e0ffec4b30496d012fa00958f794cdbd721bd155cae87", 0x109e8, 0x805, 0x0, 0x6) executing program 4: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f00000000c0)=0xabb3, 0x4) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x60000000}, 0x4000000) executing program 4: sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc008}, 0x4008010) r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000440)={0xb0000010}) executing program 3: r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x328, 0x118, 0x168, 0x9, 0x118, 0xb, 0x258, 0x250, 0x250, 0x258, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0xd0, 0x118, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xd}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 'gretap0\x00', {0x8}}}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@inet=@set3={{0x50}, {{0x4, 0x1}, {0x7, 0xe}, {0x7, 0x5}, 0xfff}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@local, 'batadv0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x388) executing program 3: socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$netlbl_calipso(0x0, 0xffffffffffffffff) r0 = socket$inet(0xa, 0x801, 0x84) listen(r0, 0xfffffffd) listen(0xffffffffffffffff, 0x8) listen(0xffffffffffffffff, 0x8) r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0x8) listen(0xffffffffffffffff, 0x1) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, 0x0, 0x20004005) executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x40, 0x5d, 0x2, 0x190b87f7}, {0x6, 0x0, 0x6, 0x1}]}, 0x10) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000140)="24000000010006", 0x7) executing program 3: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80"], 0xa8}}, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r0, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0xc8}, 0x2}, 0x0) executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x81}, 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmmsg(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f00000011c0), 0x2}}], 0x3ffffffffffff49, 0x404c840) unshare(0x600) ppoll(&(0x7f0000005240)=[{0xffffffffffffffff, 0x2}, {0xffffffffffffffff, 0x100}, {0xffffffffffffffff, 0x2}], 0x4c, &(0x7f0000005280)={0x77359400}, &(0x7f00000052c0)={[0x7]}, 0x8) executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, 0x0, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x1000d, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fffffff}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r1, 0x8b2a, &(0x7f0000000040)) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000002c00), 0x0, 0x20, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000a80)=ANY=[@ANYBLOB="0180c200000e0000000000008100200086dd63269fe000243aff20010000000000000000000000000001ff020000000000000000000000000021a4cb241ff60b366c24012c00000000000000000100000000000087009078ff0200000000000000000000000000018629d7fd43d30666ecfb3a17b06ae81dde31b3d6429a8a20dd9e9f"], 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 4: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000680)) r1 = socket(0xb, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet(0xa, 0x801, 0x84) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r7, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x5, 0x4, 0x1, 0x1, 0x14, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}}}}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x390, 0x1d0, 0x5802, 0x294, 0x0, 0x294, 0x310, 0x378, 0x378, 0x310, 0x378, 0x3, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, [0xffffff00, 0xff, 0xff000000, 0xff000000], [0xff, 0xff, 0xff, 0xff000000], 'veth0_to_hsr\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x0, 0x2, 0x80}, 0x0, 0xa8, 0x1d0, 0x52020000}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xe5f6, 'system_u:object_r:etc_aliases_t:s0\x00'}}}, {{@ipv6={@loopback, @remote, [], [0x0, 0x0, 0x0, 0xffffffff], 'ip6erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x81}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x1, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000000)=ANY=[@ANYBLOB='fi'], &(0x7f0000000100)=0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r5, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, 0x0, 0x0) executing program 0: sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000001, 0x59033, 0xffffffffffffffff, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 7, 6, 7, 8, 8, 29, 26, 15, 28] detailed listing: executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x40, 0x5d, 0x2, 0x190b87f7}, {0x6, 0x0, 0x6, 0x1}]}, 0x10) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000140)="24000000010006", 0x7) executing program 3: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80"], 0xa8}}, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r0, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0xc8}, 0x2}, 0x0) executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x81}, 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmmsg(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f00000011c0), 0x2}}], 0x3ffffffffffff49, 0x404c840) unshare(0x600) ppoll(&(0x7f0000005240)=[{0xffffffffffffffff, 0x2}, {0xffffffffffffffff, 0x100}, {0xffffffffffffffff, 0x2}], 0x4c, &(0x7f0000005280)={0x77359400}, &(0x7f00000052c0)={[0x7]}, 0x8) executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, 0x0, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x1000d, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fffffff}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r1, 0x8b2a, &(0x7f0000000040)) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000002c00), 0x0, 0x20, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000a80)=ANY=[@ANYBLOB="0180c200000e0000000000008100200086dd63269fe000243aff20010000000000000000000000000001ff020000000000000000000000000021a4cb241ff60b366c24012c00000000000000000100000000000087009078ff0200000000000000000000000000018629d7fd43d30666ecfb3a17b06ae81dde31b3d6429a8a20dd9e9f"], 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 4: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000680)) r1 = socket(0xb, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet(0xa, 0x801, 0x84) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r7, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x5, 0x4, 0x1, 0x1, 0x14, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}}}}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x390, 0x1d0, 0x5802, 0x294, 0x0, 0x294, 0x310, 0x378, 0x378, 0x310, 0x378, 0x3, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, [0xffffff00, 0xff, 0xff000000, 0xff000000], [0xff, 0xff, 0xff, 0xff000000], 'veth0_to_hsr\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x0, 0x2, 0x80}, 0x0, 0xa8, 0x1d0, 0x52020000}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xe5f6, 'system_u:object_r:etc_aliases_t:s0\x00'}}}, {{@ipv6={@loopback, @remote, [], [0x0, 0x0, 0x0, 0xffffffff], 'ip6erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x81}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x1, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000000)=ANY=[@ANYBLOB='fi'], &(0x7f0000000100)=0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r5, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, 0x0, 0x0) executing program 0: sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000001, 0x59033, 0xffffffffffffffff, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program did not crash bisect: testing without sub-chunk 3/3 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 7, 8, 5, 9, 10, 3, 6, 2, 12, 28] detailed listing: executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) recvmmsg(r0, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)=""/27, 0x1b}], 0x1}, 0x7}], 0x1, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd010000000000140000006000000000280600fe88a43de1a400000000000000027d01ff020000000000000000000000000001000088bed2868a1610e8f515ab"], 0xfdef) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x20000884}, 0x0) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400000010000100000000000072a30754a77d8b3b000000000a01010000000000000000010000000900010073797a30000000003c000000090a0104000000000000010000000c00fc53e999a94c0c54e60000000900020073797a32000000000900010073797a3000000000081d"], 0xd0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) socket$kcm(0xa, 0x3, 0x3a) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fd1ff7907001175f37538e486dd6317010000213a00db536873f45f08c6feaa70e2aef57b20000000000000000000000000ac1414aa"], 0xfdef) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xd26, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000013000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010000c800c0022"], 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x0) executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002ec0)=@newtfilter={0x4a4, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x470, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0x6}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x5}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x444, 0x2, [@m_sample={0x128, 0x9, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xfffffff7}]}, {0xf1, 0x6, "7de1d3790d9a29295dd21381068e514fa961e7905c3b7c4f6aa13057b12de84e77e664d1fa3e75eabd2798245d143eae9fa95bbc680a1c92f121822d45d02c8ad526cb383d828231fd917807ef1146ba220f3e43f539d1cb172eb84a2323f79290e28762509ca98acc80f1b6eeeac9604cb98935b7af52867208021f74dcc420fa4626adfb4671f005c9a9860ce0d9c0d636a240267fc68c53ccc49a01e9c0667766baf716128c8a339f316bd5e18563d313628cce81bcc71d575033e7e79a3649234dda5718c6eac0aa89d834101c6e3678ac0153aee7916533daf05c22e6b94ca01bc88011300a3bb258f536"}, {0xc}, {0xc}}}, @m_vlan={0x170, 0xd, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0xce, 0x3, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x4, 0x2}, 0x1}}]}, {0x102, 0x6, "194876e71e2c22f2601f26c3ddf32908021d65c9b3366c4b6264a30b78bbb979c687b9627b4a8c2e408a4b9e075182c3a72e51856f03c86cd2e3fb9c9f1ec05d119bf8bf5f10eb27f8b1f6d8c25a59932d2a29f2aa878b27368e14390c7f9d92438e8fc05c2d34ef3be36dfc0203f5823c3d1ef2457caca6a0b53b598671689892b30e32c203af2ff05f3440b6b649dd600e35c260b8b4937e9be221e2e956d3fde4c98f9e18f9dec32b9d3e6ca74f9fd508afd127655158115d915b0f74d3b05b948143c5fb1cd11b0bc2e687294d242165ed45eaf09cc9efffc4fd6aede42c33b879c549b63a734d0da8e25d51f3d4767ea877bc3cd6a1653acf4ab66f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_csum={0x1a8, 0x17, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x4, 0x7, 0x2, 0x101}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x80000000, 0x5, 0x31, 0x5}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0xc8, 0x8, 0x1c6d, 0x7}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x68b3, 0x3, 0x8, 0x4, 0x8}, 0x66}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x10000000, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfcc, 0xffffffff, 0x0, 0x0, 0x3}, 0x3f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x100, 0x7, 0x6, 0x27, 0x80000001}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0xfffffffa, 0xffffffffffffffff, 0x2, 0x3}}}]}, {0x9b, 0x6, "deb2e1945b3ffe5b487b09e9c26ae18230f29852d3ffad815db92cd3fd76c15b4ec8829ec0f04a81bdf393abb8183a27493533dabab9a6d17893e5aa3ec826c0ca0b4e00c14a2ffd69cc49d8bb8e74128c8ae722483f47ef8cc2b38babab2d7ea7163b6a3807da981f67f2688fb1906d9ff51f33df7f33bfe1056c855b2056f5b8e460e9b12a762363d6d604b92190a24787cf4c06c8bd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='yeah\x00', 0x5) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@window, @window={0x3, 0x2, 0x1}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @sack_perm, @timestamp, @mss={0x2, 0x1}, @sack_perm], 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@ipv6_newrule={0x1c, 0x20, 0x1, 0x0, 0x0, {0xa, 0x20, 0x20}}, 0x1c}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)="3ce2de4d8d957a8de4e490b6cd03b988d4edef164bd3377aa381b5f50b7ca414516489f78cd7208982e9bde22b2b7c1c7606d565477f3db9d2b077283644c0f27ab52a863a42863e06944e40a0b3c5d21c8cbe102e7f726263f28aef1bc12a069063d4c30e8f329fdb36859be727fbef4314161e5fb5f01ae00a2634d5cdecca2089c62e32f4c919886b2b88d237e287318739bec0364caf15889f38a312ef6621c0f21709a4bf2b16274cf933f6ad8fcc9c2024bc1b4713f650e860f93ae93b2361956b3e80c38c5fd29b5c1b5d7ce67edc856a8dc0ba54cee53de9a48c131389426bd06ec7c695add357934fc0321f0d3d7982e4fe5a0039decc491a663afd02facb08dd9695f854c7b031d9af8bd7350897996b5208b23030cc0feb84570730eaf24b9f2ac05d0feb3be07a29f887095f36f3c8f0e77e45509acd14a5be4a1572dd4cd1231087b830fa03e071571d4abd694710ef140469cf6df8a59839aafe046a5bffb97e5247be901789eafd726ba090337a2c49207e6b900c7e982472e6aac70e5d52ca2c1bab47b1f6d00f9601e2281686c21f770ae96e0ffec4b30496d012fa00958f794cdbd721bd155cae87", 0x109e8, 0x805, 0x0, 0x6) executing program 4: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f00000000c0)=0xabb3, 0x4) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x60000000}, 0x4000000) executing program 4: sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc008}, 0x4008010) r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000440)={0xb0000010}) executing program 3: r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x328, 0x118, 0x168, 0x9, 0x118, 0xb, 0x258, 0x250, 0x250, 0x258, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0xd0, 0x118, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xd}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 'gretap0\x00', {0x8}}}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@inet=@set3={{0x50}, {{0x4, 0x1}, {0x7, 0xe}, {0x7, 0x5}, 0xfff}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@local, 'batadv0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x388) executing program 3: socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$netlbl_calipso(0x0, 0xffffffffffffffff) r0 = socket$inet(0xa, 0x801, 0x84) listen(r0, 0xfffffffd) listen(0xffffffffffffffff, 0x8) listen(0xffffffffffffffff, 0x8) r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0x8) listen(0xffffffffffffffff, 0x1) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, 0x0, 0x20004005) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program did not crash bisect: split chunks (needed=true): <10>, <9> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 3, 6, 2, 12, 4, 7, 6, 7, 8, 8, 29, 26, 15, 28] detailed listing: executing program 0: r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e21, @local}, 0x10) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='yeah\x00', 0x5) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@window, @window={0x3, 0x2, 0x1}, @window={0x3, 0x0, 0x4}, @window={0x3, 0x8, 0x6}, @sack_perm, @timestamp, @mss={0x2, 0x1}, @sack_perm], 0x8) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@ipv6_newrule={0x1c, 0x20, 0x1, 0x0, 0x0, {0xa, 0x20, 0x20}}, 0x1c}}, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f00000004c0)="3ce2de4d8d957a8de4e490b6cd03b988d4edef164bd3377aa381b5f50b7ca414516489f78cd7208982e9bde22b2b7c1c7606d565477f3db9d2b077283644c0f27ab52a863a42863e06944e40a0b3c5d21c8cbe102e7f726263f28aef1bc12a069063d4c30e8f329fdb36859be727fbef4314161e5fb5f01ae00a2634d5cdecca2089c62e32f4c919886b2b88d237e287318739bec0364caf15889f38a312ef6621c0f21709a4bf2b16274cf933f6ad8fcc9c2024bc1b4713f650e860f93ae93b2361956b3e80c38c5fd29b5c1b5d7ce67edc856a8dc0ba54cee53de9a48c131389426bd06ec7c695add357934fc0321f0d3d7982e4fe5a0039decc491a663afd02facb08dd9695f854c7b031d9af8bd7350897996b5208b23030cc0feb84570730eaf24b9f2ac05d0feb3be07a29f887095f36f3c8f0e77e45509acd14a5be4a1572dd4cd1231087b830fa03e071571d4abd694710ef140469cf6df8a59839aafe046a5bffb97e5247be901789eafd726ba090337a2c49207e6b900c7e982472e6aac70e5d52ca2c1bab47b1f6d00f9601e2281686c21f770ae96e0ffec4b30496d012fa00958f794cdbd721bd155cae87", 0x109e8, 0x805, 0x0, 0x6) executing program 4: r0 = socket$inet(0x2, 0x3, 0x1) setsockopt$sock_int(r0, 0x1, 0x5, &(0x7f00000000c0)=0xabb3, 0x4) sendmsg$inet(r0, &(0x7f0000000040)={&(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x60000000}, 0x4000000) executing program 4: sendmsg$DEVLINK_CMD_PORT_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc008}, 0x4008010) r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r1, &(0x7f0000000440)={0xb0000010}) executing program 3: r0 = socket$inet6_icmp(0xa, 0x2, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000740)=@raw={'raw\x00', 0x3c1, 0x3, 0x328, 0x118, 0x168, 0x9, 0x118, 0xb, 0x258, 0x250, 0x250, 0x258, 0x250, 0x3, 0x0, {[{{@uncond, 0x6000000, 0xd0, 0x118, 0x0, {0x0, 0x28e}, [@inet=@rpfilter={{0x28}, {0xd}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 'gretap0\x00', {0x8}}}}, {{@uncond, 0x0, 0xf8, 0x140, 0x0, {}, [@common=@inet=@set3={{0x50}, {{0x4, 0x1}, {0x7, 0xe}, {0x7, 0x5}, 0xfff}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@local, 'batadv0\x00', {0x4}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x388) executing program 3: socket$nl_route(0x10, 0x3, 0x0) syz_genetlink_get_family_id$netlbl_calipso(0x0, 0xffffffffffffffff) r0 = socket$inet(0xa, 0x801, 0x84) listen(r0, 0xfffffffd) listen(0xffffffffffffffff, 0x8) listen(0xffffffffffffffff, 0x8) r1 = socket$inet(0xa, 0x801, 0x84) listen(r1, 0x8) listen(0xffffffffffffffff, 0x1) r2 = socket$netlink(0x10, 0x3, 0x4) writev(r2, &(0x7f0000000000)=[{&(0x7f0000000140)="480000001400190d09004beafd0d8c560a84476080ffe00600000000590000a2bc5603ca00000f7f89000000200000000101ff0000000309ff5bffff00c7e5ed5e00000000000000", 0x40b}], 0x1) sendmsg$NLBL_CALIPSO_C_ADD(0xffffffffffffffff, 0x0, 0x20004005) executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x40, 0x5d, 0x2, 0x190b87f7}, {0x6, 0x0, 0x6, 0x1}]}, 0x10) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000140)="24000000010006", 0x7) executing program 3: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80"], 0xa8}}, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r0, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0xc8}, 0x2}, 0x0) executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x81}, 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmmsg(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f00000011c0), 0x2}}], 0x3ffffffffffff49, 0x404c840) unshare(0x600) ppoll(&(0x7f0000005240)=[{0xffffffffffffffff, 0x2}, {0xffffffffffffffff, 0x100}, {0xffffffffffffffff, 0x2}], 0x4c, &(0x7f0000005280)={0x77359400}, &(0x7f00000052c0)={[0x7]}, 0x8) executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, 0x0, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x1000d, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fffffff}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r1, 0x8b2a, &(0x7f0000000040)) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000002c00), 0x0, 0x20, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000a80)=ANY=[@ANYBLOB="0180c200000e0000000000008100200086dd63269fe000243aff20010000000000000000000000000001ff020000000000000000000000000021a4cb241ff60b366c24012c00000000000000000100000000000087009078ff0200000000000000000000000000018629d7fd43d30666ecfb3a17b06ae81dde31b3d6429a8a20dd9e9f"], 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 4: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000680)) r1 = socket(0xb, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet(0xa, 0x801, 0x84) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r7, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x5, 0x4, 0x1, 0x1, 0x14, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}}}}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x390, 0x1d0, 0x5802, 0x294, 0x0, 0x294, 0x310, 0x378, 0x378, 0x310, 0x378, 0x3, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, [0xffffff00, 0xff, 0xff000000, 0xff000000], [0xff, 0xff, 0xff, 0xff000000], 'veth0_to_hsr\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x0, 0x2, 0x80}, 0x0, 0xa8, 0x1d0, 0x52020000}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xe5f6, 'system_u:object_r:etc_aliases_t:s0\x00'}}}, {{@ipv6={@loopback, @remote, [], [0x0, 0x0, 0x0, 0xffffffff], 'ip6erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x81}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x1, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000000)=ANY=[@ANYBLOB='fi'], &(0x7f0000000100)=0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r5, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, 0x0, 0x0) executing program 0: sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000001, 0x59033, 0xffffffffffffffff, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 7, 8, 5, 9, 4, 7, 6, 7, 8, 8, 29, 26, 15, 28] detailed listing: executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) recvmmsg(r0, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)=""/27, 0x1b}], 0x1}, 0x7}], 0x1, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd010000000000140000006000000000280600fe88a43de1a400000000000000027d01ff020000000000000000000000000001000088bed2868a1610e8f515ab"], 0xfdef) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x20000884}, 0x0) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400000010000100000000000072a30754a77d8b3b000000000a01010000000000000000010000000900010073797a30000000003c000000090a0104000000000000010000000c00fc53e999a94c0c54e60000000900020073797a32000000000900010073797a3000000000081d"], 0xd0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) socket$kcm(0xa, 0x3, 0x3a) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fd1ff7907001175f37538e486dd6317010000213a00db536873f45f08c6feaa70e2aef57b20000000000000000000000000ac1414aa"], 0xfdef) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xd26, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000013000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010000c800c0022"], 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x0) executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002ec0)=@newtfilter={0x4a4, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x470, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0x6}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x5}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x444, 0x2, [@m_sample={0x128, 0x9, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xfffffff7}]}, {0xf1, 0x6, "7de1d3790d9a29295dd21381068e514fa961e7905c3b7c4f6aa13057b12de84e77e664d1fa3e75eabd2798245d143eae9fa95bbc680a1c92f121822d45d02c8ad526cb383d828231fd917807ef1146ba220f3e43f539d1cb172eb84a2323f79290e28762509ca98acc80f1b6eeeac9604cb98935b7af52867208021f74dcc420fa4626adfb4671f005c9a9860ce0d9c0d636a240267fc68c53ccc49a01e9c0667766baf716128c8a339f316bd5e18563d313628cce81bcc71d575033e7e79a3649234dda5718c6eac0aa89d834101c6e3678ac0153aee7916533daf05c22e6b94ca01bc88011300a3bb258f536"}, {0xc}, {0xc}}}, @m_vlan={0x170, 0xd, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0xce, 0x3, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x4, 0x2}, 0x1}}]}, {0x102, 0x6, "194876e71e2c22f2601f26c3ddf32908021d65c9b3366c4b6264a30b78bbb979c687b9627b4a8c2e408a4b9e075182c3a72e51856f03c86cd2e3fb9c9f1ec05d119bf8bf5f10eb27f8b1f6d8c25a59932d2a29f2aa878b27368e14390c7f9d92438e8fc05c2d34ef3be36dfc0203f5823c3d1ef2457caca6a0b53b598671689892b30e32c203af2ff05f3440b6b649dd600e35c260b8b4937e9be221e2e956d3fde4c98f9e18f9dec32b9d3e6ca74f9fd508afd127655158115d915b0f74d3b05b948143c5fb1cd11b0bc2e687294d242165ed45eaf09cc9efffc4fd6aede42c33b879c549b63a734d0da8e25d51f3d4767ea877bc3cd6a1653acf4ab66f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_csum={0x1a8, 0x17, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x4, 0x7, 0x2, 0x101}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x80000000, 0x5, 0x31, 0x5}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0xc8, 0x8, 0x1c6d, 0x7}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x68b3, 0x3, 0x8, 0x4, 0x8}, 0x66}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x10000000, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfcc, 0xffffffff, 0x0, 0x0, 0x3}, 0x3f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x100, 0x7, 0x6, 0x27, 0x80000001}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0xfffffffa, 0xffffffffffffffff, 0x2, 0x3}}}]}, {0x9b, 0x6, "deb2e1945b3ffe5b487b09e9c26ae18230f29852d3ffad815db92cd3fd76c15b4ec8829ec0f04a81bdf393abb8183a27493533dabab9a6d17893e5aa3ec826c0ca0b4e00c14a2ffd69cc49d8bb8e74128c8ae722483f47ef8cc2b38babab2d7ea7163b6a3807da981f67f2688fb1906d9ff51f33df7f33bfe1056c855b2056f5b8e460e9b12a762363d6d604b92190a24787cf4c06c8bd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) executing program 3: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x40, 0x5d, 0x2, 0x190b87f7}, {0x6, 0x0, 0x6, 0x1}]}, 0x10) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000140)="24000000010006", 0x7) executing program 3: sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80"], 0xa8}}, 0x0) r0 = socket$unix(0x1, 0x5, 0x0) r1 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000100)={'vcan0\x00', 0x0}) connect$can_bcm(r1, &(0x7f00000000c0)={0x1d, r2}, 0x10) sendmsg$can_bcm(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[@ANYBLOB="0100000003ece1e40ad8871461ab0800", @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=r0, @ANYBLOB="3bf81bb9f9"], 0x20000600}, 0x1, 0x0, 0x0, 0x40000}, 0x0) sendmsg$can_bcm(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000580)=ANY=[], 0xc8}, 0x2}, 0x0) executing program 0: bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) socket$caif_stream(0x25, 0x1, 0x4) socket$nl_route(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x81}, 0x2) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000440)={&(0x7f00000003c0)={0x48, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2, 0x0, 0x1}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x20, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast2}}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4e1f}, @IPSET_ATTR_PROTO={0x5, 0x7, 0xff}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) executing program 3: socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r0, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) sendmmsg(r0, &(0x7f0000001240)=[{{0x0, 0x0, &(0x7f00000011c0), 0x2}}], 0x3ffffffffffff49, 0x404c840) unshare(0x600) ppoll(&(0x7f0000005240)=[{0xffffffffffffffff, 0x2}, {0xffffffffffffffff, 0x100}, {0xffffffffffffffff, 0x2}], 0x4c, &(0x7f0000005280)={0x77359400}, &(0x7f00000052c0)={[0x7]}, 0x8) executing program 0: bpf$PROG_LOAD(0x5, 0x0, 0x0) r0 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r0, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) setsockopt$inet_msfilter(r0, 0x0, 0x29, 0x0, 0x1c) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000040)={0x5, 0x0, 0x0, &(0x7f0000000100)='GPL\x00', 0x1000d, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7fffffff}, 0x94) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl(r1, 0x8b2a, &(0x7f0000000040)) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000002c00), 0x0, 0x20, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000a80)=ANY=[@ANYBLOB="0180c200000e0000000000008100200086dd63269fe000243aff20010000000000000000000000000001ff020000000000000000000000000021a4cb241ff60b366c24012c00000000000000000100000000000087009078ff0200000000000000000000000000018629d7fd43d30666ecfb3a17b06ae81dde31b3d6429a8a20dd9e9f"], 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 4: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000680)) r1 = socket(0xb, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet(0xa, 0x801, 0x84) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r7, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x5, 0x4, 0x1, 0x1, 0x14, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}}}}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x390, 0x1d0, 0x5802, 0x294, 0x0, 0x294, 0x310, 0x378, 0x378, 0x310, 0x378, 0x3, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, [0xffffff00, 0xff, 0xff000000, 0xff000000], [0xff, 0xff, 0xff, 0xff000000], 'veth0_to_hsr\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x0, 0x2, 0x80}, 0x0, 0xa8, 0x1d0, 0x52020000}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xe5f6, 'system_u:object_r:etc_aliases_t:s0\x00'}}}, {{@ipv6={@loopback, @remote, [], [0x0, 0x0, 0x0, 0xffffffff], 'ip6erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x81}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x1, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000000)=ANY=[@ANYBLOB='fi'], &(0x7f0000000100)=0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r5, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, 0x0, 0x0) executing program 0: sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000001, 0x59033, 0xffffffffffffffff, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: split chunk #1 of len 9 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 7, 8, 5, 9, 8, 29, 26, 15, 28] detailed listing: executing program 2: r0 = socket$packet(0x11, 0x2, 0x300) recvmmsg(r0, &(0x7f0000000400)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000180)=""/27, 0x1b}], 0x1}, 0x7}], 0x1, 0x0, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1, 0x10012, r1, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, 0x0, 0x0) executing program 2: r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000240)=ANY=[@ANYBLOB="034886dd010000000000140000006000000000280600fe88a43de1a400000000000000027d01ff020000000000000000000000000001000088bed2868a1610e8f515ab"], 0xfdef) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x20000884}, 0x0) executing program 4: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="1400000010000100000000000072a30754a77d8b3b000000000a01010000000000000000010000000900010073797a30000000003c000000090a0104000000000000010000000c00fc53e999a94c0c54e60000000900020073797a32000000000900010073797a3000000000081d"], 0xd0}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f}, 0x94) socket$kcm(0xa, 0x3, 0x3a) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fd1ff7907001175f37538e486dd6317010000213a00db536873f45f08c6feaa70e2aef57b20000000000000000000000000ac1414aa"], 0xfdef) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x0, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xd26, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000013000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010000c800c0022"], 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x0) executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002ec0)=@newtfilter={0x4a4, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x470, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0x6}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x5}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x444, 0x2, [@m_sample={0x128, 0x9, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xfffffff7}]}, {0xf1, 0x6, "7de1d3790d9a29295dd21381068e514fa961e7905c3b7c4f6aa13057b12de84e77e664d1fa3e75eabd2798245d143eae9fa95bbc680a1c92f121822d45d02c8ad526cb383d828231fd917807ef1146ba220f3e43f539d1cb172eb84a2323f79290e28762509ca98acc80f1b6eeeac9604cb98935b7af52867208021f74dcc420fa4626adfb4671f005c9a9860ce0d9c0d636a240267fc68c53ccc49a01e9c0667766baf716128c8a339f316bd5e18563d313628cce81bcc71d575033e7e79a3649234dda5718c6eac0aa89d834101c6e3678ac0153aee7916533daf05c22e6b94ca01bc88011300a3bb258f536"}, {0xc}, {0xc}}}, @m_vlan={0x170, 0xd, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0xce, 0x3, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x4, 0x2}, 0x1}}]}, {0x102, 0x6, "194876e71e2c22f2601f26c3ddf32908021d65c9b3366c4b6264a30b78bbb979c687b9627b4a8c2e408a4b9e075182c3a72e51856f03c86cd2e3fb9c9f1ec05d119bf8bf5f10eb27f8b1f6d8c25a59932d2a29f2aa878b27368e14390c7f9d92438e8fc05c2d34ef3be36dfc0203f5823c3d1ef2457caca6a0b53b598671689892b30e32c203af2ff05f3440b6b649dd600e35c260b8b4937e9be221e2e956d3fde4c98f9e18f9dec32b9d3e6ca74f9fd508afd127655158115d915b0f74d3b05b948143c5fb1cd11b0bc2e687294d242165ed45eaf09cc9efffc4fd6aede42c33b879c549b63a734d0da8e25d51f3d4767ea877bc3cd6a1653acf4ab66f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_csum={0x1a8, 0x17, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x4, 0x7, 0x2, 0x101}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x80000000, 0x5, 0x31, 0x5}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0xc8, 0x8, 0x1c6d, 0x7}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x68b3, 0x3, 0x8, 0x4, 0x8}, 0x66}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x10000000, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfcc, 0xffffffff, 0x0, 0x0, 0x3}, 0x3f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x100, 0x7, 0x6, 0x27, 0x80000001}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0xfffffffa, 0xffffffffffffffff, 0x2, 0x3}}}]}, {0x9b, 0x6, "deb2e1945b3ffe5b487b09e9c26ae18230f29852d3ffad815db92cd3fd76c15b4ec8829ec0f04a81bdf393abb8183a27493533dabab9a6d17893e5aa3ec826c0ca0b4e00c14a2ffd69cc49d8bb8e74128c8ae722483f47ef8cc2b38babab2d7ea7163b6a3807da981f67f2688fb1906d9ff51f33df7f33bfe1056c855b2056f5b8e460e9b12a762363d6d604b92190a24787cf4c06c8bd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000002c00), 0x0, 0x20, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000a80)=ANY=[@ANYBLOB="0180c200000e0000000000008100200086dd63269fe000243aff20010000000000000000000000000001ff020000000000000000000000000021a4cb241ff60b366c24012c00000000000000000100000000000087009078ff0200000000000000000000000000018629d7fd43d30666ecfb3a17b06ae81dde31b3d6429a8a20dd9e9f"], 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 4: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000680)) r1 = socket(0xb, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet(0xa, 0x801, 0x84) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r7, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x5, 0x4, 0x1, 0x1, 0x14, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}}}}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x390, 0x1d0, 0x5802, 0x294, 0x0, 0x294, 0x310, 0x378, 0x378, 0x310, 0x378, 0x3, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, [0xffffff00, 0xff, 0xff000000, 0xff000000], [0xff, 0xff, 0xff, 0xff000000], 'veth0_to_hsr\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x0, 0x2, 0x80}, 0x0, 0xa8, 0x1d0, 0x52020000}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xe5f6, 'system_u:object_r:etc_aliases_t:s0\x00'}}}, {{@ipv6={@loopback, @remote, [], [0x0, 0x0, 0x0, 0xffffffff], 'ip6erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x81}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x1, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000000)=ANY=[@ANYBLOB='fi'], &(0x7f0000000100)=0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r5, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, 0x0, 0x0) executing program 0: sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000001, 0x59033, 0xffffffffffffffff, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <5>, <4> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 9, 8, 29, 26, 15, 28] detailed listing: executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xd26, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000013000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010000c800c0022"], 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x0) executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002ec0)=@newtfilter={0x4a4, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x470, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0x6}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x5}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x444, 0x2, [@m_sample={0x128, 0x9, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xfffffff7}]}, {0xf1, 0x6, "7de1d3790d9a29295dd21381068e514fa961e7905c3b7c4f6aa13057b12de84e77e664d1fa3e75eabd2798245d143eae9fa95bbc680a1c92f121822d45d02c8ad526cb383d828231fd917807ef1146ba220f3e43f539d1cb172eb84a2323f79290e28762509ca98acc80f1b6eeeac9604cb98935b7af52867208021f74dcc420fa4626adfb4671f005c9a9860ce0d9c0d636a240267fc68c53ccc49a01e9c0667766baf716128c8a339f316bd5e18563d313628cce81bcc71d575033e7e79a3649234dda5718c6eac0aa89d834101c6e3678ac0153aee7916533daf05c22e6b94ca01bc88011300a3bb258f536"}, {0xc}, {0xc}}}, @m_vlan={0x170, 0xd, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0xce, 0x3, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x4, 0x2}, 0x1}}]}, {0x102, 0x6, "194876e71e2c22f2601f26c3ddf32908021d65c9b3366c4b6264a30b78bbb979c687b9627b4a8c2e408a4b9e075182c3a72e51856f03c86cd2e3fb9c9f1ec05d119bf8bf5f10eb27f8b1f6d8c25a59932d2a29f2aa878b27368e14390c7f9d92438e8fc05c2d34ef3be36dfc0203f5823c3d1ef2457caca6a0b53b598671689892b30e32c203af2ff05f3440b6b649dd600e35c260b8b4937e9be221e2e956d3fde4c98f9e18f9dec32b9d3e6ca74f9fd508afd127655158115d915b0f74d3b05b948143c5fb1cd11b0bc2e687294d242165ed45eaf09cc9efffc4fd6aede42c33b879c549b63a734d0da8e25d51f3d4767ea877bc3cd6a1653acf4ab66f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_csum={0x1a8, 0x17, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x4, 0x7, 0x2, 0x101}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x80000000, 0x5, 0x31, 0x5}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0xc8, 0x8, 0x1c6d, 0x7}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x68b3, 0x3, 0x8, 0x4, 0x8}, 0x66}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x10000000, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfcc, 0xffffffff, 0x0, 0x0, 0x3}, 0x3f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x100, 0x7, 0x6, 0x27, 0x80000001}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0xfffffffa, 0xffffffffffffffff, 0x2, 0x3}}}]}, {0x9b, 0x6, "deb2e1945b3ffe5b487b09e9c26ae18230f29852d3ffad815db92cd3fd76c15b4ec8829ec0f04a81bdf393abb8183a27493533dabab9a6d17893e5aa3ec826c0ca0b4e00c14a2ffd69cc49d8bb8e74128c8ae722483f47ef8cc2b38babab2d7ea7163b6a3807da981f67f2688fb1906d9ff51f33df7f33bfe1056c855b2056f5b8e460e9b12a762363d6d604b92190a24787cf4c06c8bd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000002c00), 0x0, 0x20, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000a80)=ANY=[@ANYBLOB="0180c200000e0000000000008100200086dd63269fe000243aff20010000000000000000000000000001ff020000000000000000000000000021a4cb241ff60b366c24012c00000000000000000100000000000087009078ff0200000000000000000000000000018629d7fd43d30666ecfb3a17b06ae81dde31b3d6429a8a20dd9e9f"], 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 4: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000680)) r1 = socket(0xb, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet(0xa, 0x801, 0x84) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r7, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x5, 0x4, 0x1, 0x1, 0x14, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}}}}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x390, 0x1d0, 0x5802, 0x294, 0x0, 0x294, 0x310, 0x378, 0x378, 0x310, 0x378, 0x3, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, [0xffffff00, 0xff, 0xff000000, 0xff000000], [0xff, 0xff, 0xff, 0xff000000], 'veth0_to_hsr\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x0, 0x2, 0x80}, 0x0, 0xa8, 0x1d0, 0x52020000}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xe5f6, 'system_u:object_r:etc_aliases_t:s0\x00'}}}, {{@ipv6={@loopback, @remote, [], [0x0, 0x0, 0x0, 0xffffffff], 'ip6erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x81}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x1, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000000)=ANY=[@ANYBLOB='fi'], &(0x7f0000000100)=0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r5, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, 0x0, 0x0) executing program 0: sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000001, 0x59033, 0xffffffffffffffff, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 9, 26, 15, 28] detailed listing: executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xd26, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000013000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010000c800c0022"], 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x0) executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002ec0)=@newtfilter={0x4a4, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x470, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0x6}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x5}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x444, 0x2, [@m_sample={0x128, 0x9, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xfffffff7}]}, {0xf1, 0x6, "7de1d3790d9a29295dd21381068e514fa961e7905c3b7c4f6aa13057b12de84e77e664d1fa3e75eabd2798245d143eae9fa95bbc680a1c92f121822d45d02c8ad526cb383d828231fd917807ef1146ba220f3e43f539d1cb172eb84a2323f79290e28762509ca98acc80f1b6eeeac9604cb98935b7af52867208021f74dcc420fa4626adfb4671f005c9a9860ce0d9c0d636a240267fc68c53ccc49a01e9c0667766baf716128c8a339f316bd5e18563d313628cce81bcc71d575033e7e79a3649234dda5718c6eac0aa89d834101c6e3678ac0153aee7916533daf05c22e6b94ca01bc88011300a3bb258f536"}, {0xc}, {0xc}}}, @m_vlan={0x170, 0xd, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0xce, 0x3, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x4, 0x2}, 0x1}}]}, {0x102, 0x6, "194876e71e2c22f2601f26c3ddf32908021d65c9b3366c4b6264a30b78bbb979c687b9627b4a8c2e408a4b9e075182c3a72e51856f03c86cd2e3fb9c9f1ec05d119bf8bf5f10eb27f8b1f6d8c25a59932d2a29f2aa878b27368e14390c7f9d92438e8fc05c2d34ef3be36dfc0203f5823c3d1ef2457caca6a0b53b598671689892b30e32c203af2ff05f3440b6b649dd600e35c260b8b4937e9be221e2e956d3fde4c98f9e18f9dec32b9d3e6ca74f9fd508afd127655158115d915b0f74d3b05b948143c5fb1cd11b0bc2e687294d242165ed45eaf09cc9efffc4fd6aede42c33b879c549b63a734d0da8e25d51f3d4767ea877bc3cd6a1653acf4ab66f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_csum={0x1a8, 0x17, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x4, 0x7, 0x2, 0x101}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x80000000, 0x5, 0x31, 0x5}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0xc8, 0x8, 0x1c6d, 0x7}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x68b3, 0x3, 0x8, 0x4, 0x8}, 0x66}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x10000000, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfcc, 0xffffffff, 0x0, 0x0, 0x3}, 0x3f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x100, 0x7, 0x6, 0x27, 0x80000001}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0xfffffffa, 0xffffffffffffffff, 0x2, 0x3}}}]}, {0x9b, 0x6, "deb2e1945b3ffe5b487b09e9c26ae18230f29852d3ffad815db92cd3fd76c15b4ec8829ec0f04a81bdf393abb8183a27493533dabab9a6d17893e5aa3ec826c0ca0b4e00c14a2ffd69cc49d8bb8e74128c8ae722483f47ef8cc2b38babab2d7ea7163b6a3807da981f67f2688fb1906d9ff51f33df7f33bfe1056c855b2056f5b8e460e9b12a762363d6d604b92190a24787cf4c06c8bd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) executing program 4: r0 = socket$phonet_pipe(0x23, 0x5, 0x2) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r0, 0x81f8943c, &(0x7f0000000680)) r1 = socket(0xb, 0x2, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x89f1, &(0x7f00000002c0)={'ip6gre0\x00', &(0x7f0000000300)=@ethtool_rxnfc={0x2f, 0x2, 0x6, {0xe, @usr_ip6_spec={@empty, @dev={0xfe, 0x80, '\x00', 0x24}, 0xfffffff8, 0x3d, 0xe}, {0x0, @remote, 0xe, 0x4, [0x7, 0x6]}, @ah_ip4_spec={@remote, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x5}, {0x0, @broadcast, 0x8, 0x5, [0xf, 0x9]}, 0xff, 0x3}}}) socket$inet6_mptcp(0xa, 0x1, 0x106) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) socket$rds(0x15, 0x5, 0x0) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000800000000bf91000000000000b702000043e7b5538500000085000000b70000000000000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000140)='kmem_cache_free\x00', r4}, 0x10) ppoll(&(0x7f0000000500)=[{r3}], 0x1, 0x0, 0x0, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) r7 = socket$inet(0xa, 0x801, 0x84) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r7, 0x8) recvmmsg(0xffffffffffffffff, &(0x7f0000003dc0)=[{{0x0, 0x0, &(0x7f0000000640)=[{&(0x7f0000000040)=""/94, 0x5e}], 0x1}, 0x5076}], 0x1, 0x20, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r6, 0x89f3, &(0x7f0000000040)={'syztnl2\x00', &(0x7f0000000200)={'sit0\x00', 0x0, 0x40, 0x7800, 0x7, 0x7, {{0x5, 0x4, 0x1, 0x1, 0x14, 0x64, 0x0, 0x1, 0x4, 0x0, @initdev={0xac, 0x1e, 0x1, 0x0}, @dev={0xac, 0x14, 0x14, 0x15}}}}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) setsockopt$IP6T_SO_SET_REPLACE(0xffffffffffffffff, 0x29, 0x40, &(0x7f0000000a00)=@raw={'raw\x00', 0x3c1, 0x1a6cc7, 0x390, 0x1d0, 0x5802, 0x294, 0x0, 0x294, 0x310, 0x378, 0x378, 0x310, 0x378, 0x3, 0x0, {[{{@ipv6={@mcast2, @ipv4={'\x00', '\xff\xff', @private=0xa010101}, [0xffffff00, 0xff, 0xff000000, 0xff000000], [0xff, 0xff, 0xff, 0xff000000], 'veth0_to_hsr\x00', 'vlan0\x00', {0xff}, {0xff}, 0x0, 0x0, 0x2, 0x80}, 0x0, 0xa8, 0x1d0, 0x52020000}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0xe5f6, 'system_u:object_r:etc_aliases_t:s0\x00'}}}, {{@ipv6={@loopback, @remote, [], [0x0, 0x0, 0x0, 0xffffffff], 'ip6erspan0\x00', 'gre0\x00', {0xff}, {}, 0x0, 0x81}, 0x0, 0xa8, 0xf0}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x1, 0x3, 0x1, 0x0, 'netbios-ns\x00', {0x5}}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x3f0) getsockopt$ARPT_SO_GET_ENTRIES(0xffffffffffffffff, 0x0, 0x61, &(0x7f0000000000)=ANY=[@ANYBLOB='fi'], &(0x7f0000000100)=0x28) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x22051, r5, 0x0) setsockopt$inet_msfilter(r1, 0x0, 0x29, 0x0, 0x0) executing program 0: sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, 0x0, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r1, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000002}) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x800, 0x0) r3 = dup3(r2, r1, 0x0) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r4, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r4, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a, 0x4}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000580)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x11, 0x0, 0x0, 0x0, 0x18, 0x0, &(0x7f0000000240)={0x30, 0x30, 0x30}}, 0x1000}], 0x0, 0x0, 0x0}) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x2000001, 0x59033, 0xffffffffffffffff, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) writev(r5, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 9, 8, 29, 28] detailed listing: executing program 4: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xd26, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x8, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3000000013000100000000000000000007000000", @ANYRES32=r2, @ANYBLOB="000000000000000010000c800c0022"], 0x30}, 0x1, 0x0, 0x0, 0x8004}, 0x0) executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002ec0)=@newtfilter={0x4a4, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x470, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0x6}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x5}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x444, 0x2, [@m_sample={0x128, 0x9, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xfffffff7}]}, {0xf1, 0x6, "7de1d3790d9a29295dd21381068e514fa961e7905c3b7c4f6aa13057b12de84e77e664d1fa3e75eabd2798245d143eae9fa95bbc680a1c92f121822d45d02c8ad526cb383d828231fd917807ef1146ba220f3e43f539d1cb172eb84a2323f79290e28762509ca98acc80f1b6eeeac9604cb98935b7af52867208021f74dcc420fa4626adfb4671f005c9a9860ce0d9c0d636a240267fc68c53ccc49a01e9c0667766baf716128c8a339f316bd5e18563d313628cce81bcc71d575033e7e79a3649234dda5718c6eac0aa89d834101c6e3678ac0153aee7916533daf05c22e6b94ca01bc88011300a3bb258f536"}, {0xc}, {0xc}}}, @m_vlan={0x170, 0xd, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0xce, 0x3, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x4, 0x2}, 0x1}}]}, {0x102, 0x6, "194876e71e2c22f2601f26c3ddf32908021d65c9b3366c4b6264a30b78bbb979c687b9627b4a8c2e408a4b9e075182c3a72e51856f03c86cd2e3fb9c9f1ec05d119bf8bf5f10eb27f8b1f6d8c25a59932d2a29f2aa878b27368e14390c7f9d92438e8fc05c2d34ef3be36dfc0203f5823c3d1ef2457caca6a0b53b598671689892b30e32c203af2ff05f3440b6b649dd600e35c260b8b4937e9be221e2e956d3fde4c98f9e18f9dec32b9d3e6ca74f9fd508afd127655158115d915b0f74d3b05b948143c5fb1cd11b0bc2e687294d242165ed45eaf09cc9efffc4fd6aede42c33b879c549b63a734d0da8e25d51f3d4767ea877bc3cd6a1653acf4ab66f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_csum={0x1a8, 0x17, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x4, 0x7, 0x2, 0x101}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x80000000, 0x5, 0x31, 0x5}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0xc8, 0x8, 0x1c6d, 0x7}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x68b3, 0x3, 0x8, 0x4, 0x8}, 0x66}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x10000000, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfcc, 0xffffffff, 0x0, 0x0, 0x3}, 0x3f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x100, 0x7, 0x6, 0x27, 0x80000001}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0xfffffffa, 0xffffffffffffffff, 0x2, 0x3}}}]}, {0x9b, 0x6, "deb2e1945b3ffe5b487b09e9c26ae18230f29852d3ffad815db92cd3fd76c15b4ec8829ec0f04a81bdf393abb8183a27493533dabab9a6d17893e5aa3ec826c0ca0b4e00c14a2ffd69cc49d8bb8e74128c8ae722483f47ef8cc2b38babab2d7ea7163b6a3807da981f67f2688fb1906d9ff51f33df7f33bfe1056c855b2056f5b8e460e9b12a762363d6d604b92190a24787cf4c06c8bd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000002c00), 0x0, 0x20, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000a80)=ANY=[@ANYBLOB="0180c200000e0000000000008100200086dd63269fe000243aff20010000000000000000000000000001ff020000000000000000000000000021a4cb241ff60b366c24012c00000000000000000100000000000087009078ff0200000000000000000000000000018629d7fd43d30666ecfb3a17b06ae81dde31b3d6429a8a20dd9e9f"], 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: split chunks (needed=true): <2>, <2> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 8, 29, 28] detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002ec0)=@newtfilter={0x4a4, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x470, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0x6}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x5}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x444, 0x2, [@m_sample={0x128, 0x9, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xfffffff7}]}, {0xf1, 0x6, "7de1d3790d9a29295dd21381068e514fa961e7905c3b7c4f6aa13057b12de84e77e664d1fa3e75eabd2798245d143eae9fa95bbc680a1c92f121822d45d02c8ad526cb383d828231fd917807ef1146ba220f3e43f539d1cb172eb84a2323f79290e28762509ca98acc80f1b6eeeac9604cb98935b7af52867208021f74dcc420fa4626adfb4671f005c9a9860ce0d9c0d636a240267fc68c53ccc49a01e9c0667766baf716128c8a339f316bd5e18563d313628cce81bcc71d575033e7e79a3649234dda5718c6eac0aa89d834101c6e3678ac0153aee7916533daf05c22e6b94ca01bc88011300a3bb258f536"}, {0xc}, {0xc}}}, @m_vlan={0x170, 0xd, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0xce, 0x3, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x4, 0x2}, 0x1}}]}, {0x102, 0x6, "194876e71e2c22f2601f26c3ddf32908021d65c9b3366c4b6264a30b78bbb979c687b9627b4a8c2e408a4b9e075182c3a72e51856f03c86cd2e3fb9c9f1ec05d119bf8bf5f10eb27f8b1f6d8c25a59932d2a29f2aa878b27368e14390c7f9d92438e8fc05c2d34ef3be36dfc0203f5823c3d1ef2457caca6a0b53b598671689892b30e32c203af2ff05f3440b6b649dd600e35c260b8b4937e9be221e2e956d3fde4c98f9e18f9dec32b9d3e6ca74f9fd508afd127655158115d915b0f74d3b05b948143c5fb1cd11b0bc2e687294d242165ed45eaf09cc9efffc4fd6aede42c33b879c549b63a734d0da8e25d51f3d4767ea877bc3cd6a1653acf4ab66f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_csum={0x1a8, 0x17, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x4, 0x7, 0x2, 0x101}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x80000000, 0x5, 0x31, 0x5}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0xc8, 0x8, 0x1c6d, 0x7}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x68b3, 0x3, 0x8, 0x4, 0x8}, 0x66}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x10000000, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfcc, 0xffffffff, 0x0, 0x0, 0x3}, 0x3f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x100, 0x7, 0x6, 0x27, 0x80000001}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0xfffffffa, 0xffffffffffffffff, 0x2, 0x3}}}]}, {0x9b, 0x6, "deb2e1945b3ffe5b487b09e9c26ae18230f29852d3ffad815db92cd3fd76c15b4ec8829ec0f04a81bdf393abb8183a27493533dabab9a6d17893e5aa3ec826c0ca0b4e00c14a2ffd69cc49d8bb8e74128c8ae722483f47ef8cc2b38babab2d7ea7163b6a3807da981f67f2688fb1906d9ff51f33df7f33bfe1056c855b2056f5b8e460e9b12a762363d6d604b92190a24787cf4c06c8bd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) executing program 4: r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4000) recvmmsg(0xffffffffffffffff, &(0x7f0000002c00), 0x0, 0x20, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DEFAULT_GET(0xffffffffffffffff, 0x0, 0x0) bind$inet(0xffffffffffffffff, 0x0, 0x0) syz_emit_ethernet(0x5e, &(0x7f0000000a80)=ANY=[@ANYBLOB="0180c200000e0000000000008100200086dd63269fe000243aff20010000000000000000000000000001ff020000000000000000000000000021a4cb241ff60b366c24012c00000000000000000100000000000087009078ff0200000000000000000000000000018629d7fd43d30666ecfb3a17b06ae81dde31b3d6429a8a20dd9e9f"], 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [9, 29, 28] detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002ec0)=@newtfilter={0x4a4, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x470, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0x6}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x5}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x444, 0x2, [@m_sample={0x128, 0x9, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xfffffff7}]}, {0xf1, 0x6, "7de1d3790d9a29295dd21381068e514fa961e7905c3b7c4f6aa13057b12de84e77e664d1fa3e75eabd2798245d143eae9fa95bbc680a1c92f121822d45d02c8ad526cb383d828231fd917807ef1146ba220f3e43f539d1cb172eb84a2323f79290e28762509ca98acc80f1b6eeeac9604cb98935b7af52867208021f74dcc420fa4626adfb4671f005c9a9860ce0d9c0d636a240267fc68c53ccc49a01e9c0667766baf716128c8a339f316bd5e18563d313628cce81bcc71d575033e7e79a3649234dda5718c6eac0aa89d834101c6e3678ac0153aee7916533daf05c22e6b94ca01bc88011300a3bb258f536"}, {0xc}, {0xc}}}, @m_vlan={0x170, 0xd, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0xce, 0x3, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x4, 0x2}, 0x1}}]}, {0x102, 0x6, "194876e71e2c22f2601f26c3ddf32908021d65c9b3366c4b6264a30b78bbb979c687b9627b4a8c2e408a4b9e075182c3a72e51856f03c86cd2e3fb9c9f1ec05d119bf8bf5f10eb27f8b1f6d8c25a59932d2a29f2aa878b27368e14390c7f9d92438e8fc05c2d34ef3be36dfc0203f5823c3d1ef2457caca6a0b53b598671689892b30e32c203af2ff05f3440b6b649dd600e35c260b8b4937e9be221e2e956d3fde4c98f9e18f9dec32b9d3e6ca74f9fd508afd127655158115d915b0f74d3b05b948143c5fb1cd11b0bc2e687294d242165ed45eaf09cc9efffc4fd6aede42c33b879c549b63a734d0da8e25d51f3d4767ea877bc3cd6a1653acf4ab66f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_csum={0x1a8, 0x17, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x4, 0x7, 0x2, 0x101}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x80000000, 0x5, 0x31, 0x5}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0xc8, 0x8, 0x1c6d, 0x7}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x68b3, 0x3, 0x8, 0x4, 0x8}, 0x66}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x10000000, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfcc, 0xffffffff, 0x0, 0x0, 0x3}, 0x3f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x100, 0x7, 0x6, 0x27, 0x80000001}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0xfffffffa, 0xffffffffffffffff, 0x2, 0x3}}}]}, {0x9b, 0x6, "deb2e1945b3ffe5b487b09e9c26ae18230f29852d3ffad815db92cd3fd76c15b4ec8829ec0f04a81bdf393abb8183a27493533dabab9a6d17893e5aa3ec826c0ca0b4e00c14a2ffd69cc49d8bb8e74128c8ae722483f47ef8cc2b38babab2d7ea7163b6a3807da981f67f2688fb1906d9ff51f33df7f33bfe1056c855b2056f5b8e460e9b12a762363d6d604b92190a24787cf4c06c8bd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <1>, <1> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunk #1 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 3 programs left: executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002ec0)=@newtfilter={0x4a4, 0x28, 0xd27, 0x70bd2d, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {}, {0x9, 0xb}}, [@filter_kind_options=@f_matchall={{0xd}, {0x470, 0x2, [@TCA_MATCHALL_CLASSID={0x8, 0x1, {0x7, 0xe}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x2}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xf, 0x6}}, @TCA_MATCHALL_CLASSID={0x8, 0x1, {0xffff, 0x5}}, @TCA_MATCHALL_FLAGS={0x8, 0x3, 0x1}, @TCA_MATCHALL_ACT={0x444, 0x2, [@m_sample={0x128, 0x9, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0xfffffff7}]}, {0xf1, 0x6, "7de1d3790d9a29295dd21381068e514fa961e7905c3b7c4f6aa13057b12de84e77e664d1fa3e75eabd2798245d143eae9fa95bbc680a1c92f121822d45d02c8ad526cb383d828231fd917807ef1146ba220f3e43f539d1cb172eb84a2323f79290e28762509ca98acc80f1b6eeeac9604cb98935b7af52867208021f74dcc420fa4626adfb4671f005c9a9860ce0d9c0d636a240267fc68c53ccc49a01e9c0667766baf716128c8a339f316bd5e18563d313628cce81bcc71d575033e7e79a3649234dda5718c6eac0aa89d834101c6e3678ac0153aee7916533daf05c22e6b94ca01bc88011300a3bb258f536"}, {0xc}, {0xc}}}, @m_vlan={0x170, 0xd, 0x0, 0x0, {{0x9}, {0x44, 0x2, 0x0, 0x1, [@TCA_VLAN_PARMS={0x1c, 0x2, {{0x4, 0xce, 0x3, 0x1}, 0x2}}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PARMS={0x1c, 0x2, {{0x3, 0x5, 0x4, 0x2}, 0x1}}]}, {0x102, 0x6, "194876e71e2c22f2601f26c3ddf32908021d65c9b3366c4b6264a30b78bbb979c687b9627b4a8c2e408a4b9e075182c3a72e51856f03c86cd2e3fb9c9f1ec05d119bf8bf5f10eb27f8b1f6d8c25a59932d2a29f2aa878b27368e14390c7f9d92438e8fc05c2d34ef3be36dfc0203f5823c3d1ef2457caca6a0b53b598671689892b30e32c203af2ff05f3440b6b649dd600e35c260b8b4937e9be221e2e956d3fde4c98f9e18f9dec32b9d3e6ca74f9fd508afd127655158115d915b0f74d3b05b948143c5fb1cd11b0bc2e687294d242165ed45eaf09cc9efffc4fd6aede42c33b879c549b63a734d0da8e25d51f3d4767ea877bc3cd6a1653acf4ab66f"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}, @m_csum={0x1a8, 0x17, 0x0, 0x0, {{0x9}, {0xe4, 0x2, 0x0, 0x1, [@TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0x4, 0x7, 0x2, 0x101}, 0x1}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x4, 0x80000000, 0x5, 0x31, 0x5}, 0x31}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x6, 0xc8, 0x8, 0x1c6d, 0x7}, 0x55}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x68b3, 0x3, 0x8, 0x4, 0x8}, 0x66}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1ff, 0x5, 0x10000000, 0x5, 0x1}, 0x67}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0xfcc, 0xffffffff, 0x0, 0x0, 0x3}, 0x3f}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x100, 0x7, 0x6, 0x27, 0x80000001}, 0x5a}}, @TCA_CSUM_PARMS={0x1c, 0x1, {{0x1, 0xfffffffa, 0xffffffffffffffff, 0x2, 0x3}}}]}, {0x9b, 0x6, "deb2e1945b3ffe5b487b09e9c26ae18230f29852d3ffad815db92cd3fd76c15b4ec8829ec0f04a81bdf393abb8183a27493533dabab9a6d17893e5aa3ec826c0ca0b4e00c14a2ffd69cc49d8bb8e74128c8ae722483f47ef8cc2b38babab2d7ea7163b6a3807da981f67f2688fb1906d9ff51f33df7f33bfe1056c855b2056f5b8e460e9b12a762363d6d604b92190a24787cf4c06c8bd"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x3}}}}]}]}}]}, 0x4a4}, 0x1, 0x0, 0x0, 0x810}, 0x40040c4) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) bisect: trying to concatenate bisect: concatenate 3 entries minimizing program #0 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 29, 28] detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) r3 = socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x44, 0x24, 0x5820a61ca228659, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0x9}, {0xffff, 0xffff}, {0x0, 0x7}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0xffffffffffffffdb, 0x3, {0x6, 0x2}}}}]}, 0x44}}, 0x800) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 29, 28] detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) socket(0x10, 0x3, 0x0) getsockname$packet(r0, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000003c0)=0x14) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 29, 28] detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) socket(0x10, 0x3, 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 29, 28] detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="400000001000390400"/20, @ANYRES32=r1, @ANYRES32=r1], 0x40}, 0x1, 0x0, 0x0, 0x4014}, 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 29, 28] detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) socket$nl_route(0x10, 0x3, 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 29, 28] detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) getsockname$packet(r0, &(0x7f0000000140)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x28a) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 29, 28] detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 29, 28] detailed listing: executing program 0: socket(0x10, 0x803, 0x0) executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 29, 28] detailed listing: executing program 0: executing program 3: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) recvmsg(r9, &(0x7f000000b680)={0x0, 0x0, &(0x7f000000b600)=[{&(0x7f000000b500)=""/153, 0x99}], 0x1}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release minimized 9 calls -> 0 calls minimizing program #1 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 28, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) close(r11) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 27, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) setsockopt$SO_TIMESTAMPING(r11, 0x1, 0x25, &(0x7f0000000000)=0x24d2, 0x60) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 26, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) r11 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r11, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0xffffff8c) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 25, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) socket$inet6(0xa, 0x3, 0xff) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 24, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000004c0)='kmem_cache_free\x00', r10}, 0x18) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 23, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 22, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r7 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r7, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r6, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r8 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r8, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r8, &(0x7f0000000000), 0x0) r9 = accept(r0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000022c0)=@newtfilter={0xcb0, 0x2c, 0x2, 0x70bd27, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {0xd, 0x10}, {0x4, 0x2}, {0xffff, 0xfff2}}, [@f_rsvp6={{0xa}, {0x548, 0x2, [@TCA_RSVP_ACT={0x510, 0x6, [@m_connmark={0x130, 0x1a, 0x0, 0x0, {{0xd}, {0x58, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x4, 0xffffffffffffffff, 0x8, 0x2f}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x3, 0x0, 0xf3}}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x5d1f1f83, 0x10001, 0x6, 0x7, 0x2}, 0x6}}]}, {0xaa, 0x6, "19dbd6aa690a511be4ee3903a4d0c544a4a0906939411e6f431a4a0f9c3211a730ecfe04e39b483d9ee3d7fc68e7ae1e646cc9af0f6735f7066908d7a1fa76114fe456c2807e8ed70204a25f79b62c267d435eff84cf58698c32ce426d9306a437eb816cc0d5c1be2d7ca2e190e3a7acd5d78e22a80e2327f1d26c5cd16cd1acecc94a31d0c36c1b80495089401163795456adab59772c0df3371883011862e63552bf70b255"}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}, @m_ctinfo={0x78, 0x0, 0x0, 0x0, {{0xb}, {0x2c, 0x2, 0x0, 0x1, [@TCA_CTINFO_PARMS_DSCP_STATEMASK={0x8, 0x6, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x5}, @TCA_CTINFO_PARMS_DSCP_MASK={0x8, 0x5, 0x7fff}, @TCA_CTINFO_PARMS_CPMARK_MASK={0x8, 0x7, 0x3}, @TCA_CTINFO_ZONE={0x6, 0x4, 0x401}]}, {0x21, 0x6, "a870af3546bed8ba32a1a661afbd136b233576ee909508954212e1e8d7"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x2}}}}, @m_xt={0xe4, 0xc, 0x0, 0x0, {{0x7}, {0x14, 0x2, 0x0, 0x1, [@TCA_IPT_INDEX={0x8, 0x3, 0x6}, @TCA_IPT_INDEX={0x8, 0x3, 0x4}]}, {0xaa, 0x6, "48477dcf88c69c079d44bf43c44e8ebb66d756fcd270161319fa393decb8e94f10bf8323f722d8117625c34c70c7890969cbcc3d5e5f7d86a3fee7eea6608a3f3d744b99128c9dd204f7f1e8b9ad23f38c9c0f01dbc2b155870b5e324a29473e1cb09da19a6980982c35eac441e5ba5ef7cf59950d823f5f4d28e42a77b3a7e7e0a90f4ca1f91c614409bee636fe32674ef138feffd8eb2c0b43214ef759ccc510a6f3c6951a"}, {0xc}, {0xc, 0x8, {0x1, 0x2}}}}, @m_connmark={0xac, 0x19, 0x0, 0x0, {{0xd}, {0x3c, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x8, 0x2, 0x5, 0x0, 0xc5f}, 0xa67a}}, @TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x9, 0x9, 0x20000000, 0x1, 0x3b74}, 0x5d4}}]}, {0x42, 0x6, "d95b9f31e9cd4040777d9bec3cb8a77a4cb6f139906c181a5cafcedc885eca28f948e03ff0602d50d3be7dc809986365661d066e5d0aa3b1e3bb32ea7ee6"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3}}}}, @m_bpf={0xa8, 0xb, 0x0, 0x0, {{0x8}, {0x60, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x3}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x8, 0x2, 0x3, 0x1, 0xfffffffa}}, @TCA_ACT_BPF_PARMS={0x18, 0x2, {0x9590, 0xe67, 0x5, 0x5, 0x3}}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x2}, @TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x4}, @TCA_ACT_BPF_NAME={0xc, 0x6, './file0\x00'}]}, {0x22, 0x6, "1b8b5f53cdd21232cdf603fe832ff2599b5ce322451bbc018936eae3163e"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_vlan={0x12c, 0xf, 0x0, 0x0, {{0x9}, {0x24, 0x2, 0x0, 0x1, [@TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x8100}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x252}, @TCA_VLAN_PUSH_VLAN_PROTOCOL={0x6, 0x4, 0x88a8}, @TCA_VLAN_PUSH_VLAN_ID={0x6, 0x3, 0x321}]}, {0xe0, 0x6, "648772b26a0074755f1c94f548d58a58230e4ceae069c7b78c7652a304f483f345393f8346f062a3b1080ef9343155ef73bd96e4ed2fb58fcd700bf651985b4c0c7ebe4a69d47795374e2cd35e4d43333c1180d33befef2efed9acaf871ea773b1506305c09847245bd95d6f735295e2601f5116754b69b5455523f9567e32e46cbbbd3abe17ecec7a1c8afc5e540c469ef1f02a9f5fecd466685a0c06709958c8908958eae84bb7856f94eb8d9e471982a5c6b08f3b2235886ea87fbfe37850e583d2e872e75f0f3a931e871ba01d2b671b66276e9b0a0b3efd1dac"}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}, @TCA_RSVP_CLASSID={0x8, 0x1, {0x2, 0xffff}}, @TCA_RSVP_SRC={0x14, 0x3, @private1={0xfc, 0x1, '\x00', 0x1}}, @TCA_RSVP_SRC={0x14, 0x3, @mcast1}, @TCA_RSVP_POLICE={0x4}]}}, @f_rsvp6={{0xa}, {0x194, 0x2, [@TCA_RSVP_DST={0x14, 0x2, @private2}, @TCA_RSVP_ACT={0x17c, 0x6, [@m_connmark={0x9c, 0x8, 0x0, 0x0, {{0xd}, {0x20, 0x2, 0x0, 0x1, [@TCA_CONNMARK_PARMS={0x1c, 0x1, {{0x6, 0x8, 0x10000000, 0x3, 0x5}, 0xfff}}]}, {0x4f, 0x6, "a219493621288d31c429dc74a0e9727ae0361941819b97c4eea0dd86ee4eb4ded76af20703af4bbe8506ade69d4a2674f912b87c86f4007e726fd178961e4c0a4ee4b8ef9bb7e84326c228"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_mirred={0xdc, 0x6, 0x0, 0x0, {{0xb}, {0x44, 0x2, 0x0, 0x1, [@TCA_MIRRED_PARMS={0x20, 0x2, {{0x1b6, 0x8, 0x20000000, 0x0, 0x7fffffff}, 0x1, r5}}, @TCA_MIRRED_PARMS={0x20, 0x2, {{0xfffffffa, 0x8, 0x0, 0x0, 0x24}, 0x2}}]}, {0x6d, 0x6, "91b849f449f2dbc8117ed4c2038b998ae9fff66e425d81bda42571de2e78bcaff459cf658e246fcd8e06374ab7d3ae6ed34ce1f3da81059fed3f4b18ef7141be5482ec9590f85d5b127091b9f0c1e6e03752c0ba22ea69b9b4d05cae4b4be756327505790e55c6cd05"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x1}}}}]}]}}, @f_rsvp6={{0xa}, {0x58c, 0x2, [@TCA_RSVP_ACT={0x120, 0x6, [@m_gact={0x11c, 0x1e, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x1, 0x7d2, 0x4}}]}, {0xe2, 0x6, "da8be89fce2f158057ec5d5dd2301a9634e631642b6a0fa29ad2f05fe982d126780f7ed6c4a0e04b17bc116588e9ebbdf565f695cb22d61d9a162270c90ba0d67f6d518eaa26c33c909057d9a40a7dcfb16ac7f314e98c38c2dde13124bf39b7c76e34f980cdd70142fca1dc73c6e8f010ea536a093a7de2cceba46b4024ef08da35c9e7a18ebf88fbf2f85d39aff60fddec129904bb27990a60979147ff8785e7d4b20091e90d9631b65bcd50c11a25ad26b7314439716d41526be206a80bd1fe68f31ca3c69da251d5b34a11708bcd2e400be33144e727d60f0078903e"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1}}}}]}, @TCA_RSVP_DST={0x14, 0x2, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}, @TCA_RSVP_POLICE={0x42c, 0x5, [@TCA_POLICE_RATE64={0xc, 0x8, 0x2}, @TCA_POLICE_RATE64={0xc, 0x8, 0x4}, @TCA_POLICE_RATE64={0xc, 0x8, 0x9}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x3, 0xeb, 0x8, 0xfb, 0x2, 0x3, 0x1, 0xd, 0xd, 0x0, 0x40, 0x80000000, 0x3ff, 0xe, 0x100, 0x7f, 0xffffe00d, 0x7, 0x9, 0x8, 0x100, 0x6, 0x100, 0x999, 0x80000000, 0x1, 0x4, 0x5, 0xfb5, 0x6, 0x1, 0x0, 0x6, 0xf2cd, 0x7fff, 0x10, 0xffff, 0xf, 0x4, 0x9, 0x2, 0x7, 0x29c9, 0x1, 0x80000000, 0xfffffea8, 0xe, 0x5, 0x6, 0x7c5b, 0x10, 0x744, 0xc5f, 0x3ff, 0xc, 0xe, 0xffff, 0x6, 0x1, 0x4, 0x446, 0x3, 0x3, 0xd6, 0x3ff, 0x0, 0x4e5, 0xc, 0xf, 0x2, 0x5, 0xfffffff8, 0x7, 0x7fff, 0x93, 0x18000000, 0x8, 0x9, 0x408, 0x9, 0x4, 0x2, 0x0, 0x401, 0xd, 0xe, 0x0, 0xd, 0x2, 0x1c00000, 0x8, 0x8, 0x46, 0x8, 0x5, 0x4, 0x1, 0x9, 0x7, 0x6, 0x8, 0xffff0e5b, 0xa, 0x8f4, 0x5, 0x9, 0x1, 0x2, 0xffff, 0x4, 0x80007, 0x3ff, 0xb63, 0xfff0, 0x6, 0x3a, 0x3ff, 0x0, 0x400, 0x9, 0x0, 0x3, 0x1ee40, 0x7c, 0x0, 0x0, 0x40, 0x9, 0x4, 0xfffffffb, 0x5, 0xc, 0x1, 0x0, 0x3ff, 0x995, 0x4d8, 0xed9, 0x9, 0x8, 0xfffffffc, 0x10, 0xf2da, 0x1, 0x2, 0xfffffff9, 0x0, 0x8, 0x21, 0x400, 0x8, 0x9, 0x60eb10cc, 0x976b, 0x6, 0x1, 0x1, 0x3, 0xfffffff6, 0x8, 0x0, 0x6, 0xe, 0xfffffffe, 0x3ff, 0xe8, 0x26b, 0x9, 0xaa, 0x9, 0x4, 0x1686, 0x2, 0x9, 0x1, 0xfa, 0x0, 0x4, 0xfffffff7, 0xb0, 0x3, 0xffffffff, 0x80000000, 0xfffffffe, 0x9b, 0x2, 0x6, 0xd7, 0x5, 0x3, 0x10000, 0xe, 0x4, 0x9, 0x600000, 0xa8, 0x7, 0x3, 0x7ff, 0xfd4, 0x400, 0x5, 0x9, 0x80, 0x3, 0x1, 0x5, 0x9, 0xff, 0x4, 0xfffffff9, 0x0, 0x4f390f23, 0x7fffffff, 0xa, 0x6, 0x40, 0x9, 0x0, 0xfffffc01, 0x6, 0x3, 0x9, 0x6, 0x6, 0x4, 0x2b, 0x7, 0x1, 0x7, 0xcb, 0x7, 0x7b8, 0x3, 0x1, 0xa, 0x7fff, 0xf, 0x4, 0x2, 0x101, 0x10, 0x7d, 0x5, 0x6b6d, 0x418, 0x3, 0x0, 0xf57, 0x10000, 0xe4, 0xfffffff0, 0x6, 0x8, 0x48961b03, 0x5ba9]}]}, @TCA_RSVP_SRC={0x14, 0x3, @loopback}]}}]}, 0xcb0}, 0x1, 0x0, 0x0, 0x8000}, 0x200048c5) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 21, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r6 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r6, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r5, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r7 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r7, &(0x7f0000000000), 0x0) accept(r0, 0x0, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 20, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r6 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r6, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r5, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r7 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) write(r7, &(0x7f0000000000), 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 19, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r6 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r6, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r5, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r7 = socket(0x10, 0x3, 0x10007) setsockopt$netlink_NETLINK_TX_RING(r7, 0x10e, 0xc, &(0x7f0000000180)={0x1010007, 0x0, 0xfffffffc}, 0x10) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 18, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r6 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r6, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r5, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) socket(0x10, 0x3, 0x10007) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 17, 28] detailed listing: executing program 0: executing program 0: r0 = socket$alg(0x26, 0x5, 0x0) r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r3) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r2) r6 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r6, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r5, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r2) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r1) r5 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r5, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) bind$alg(r4, &(0x7f0000000100)={0x26, 'skcipher\x00', 0x0, 0x0, 'ctr-aes-neon\x00'}, 0x58) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 15, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r2) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r1) r4 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r4, 0x0, 0x0, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8943, &(0x7f0000002280)={'syzkaller0\x00'}) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 14, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r2) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r1) r4 = socket(0x1e, 0x5, 0x0) accept4$nfc_llcp(r4, 0x0, 0x0, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 13, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r2) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r1) socket(0x1e, 0x5, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 12, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r2) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) close(r1) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r1) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', @broadcast}) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r1) socketpair(0x1, 0x1, 0x0, &(0x7f0000000200)) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 9, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) close(r1) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 7, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x7101}) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 1, 28] detailed listing: executing program 0: executing program 0: socket$alg(0x26, 0x5, 0x0) executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 28] detailed listing: executing program 0: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) socket$kcm(0x10, 0x2, 0x0) program crashed: KASAN: use-after-free Read in ax25_release minimized 29 calls -> 0 calls minimizing program #2 before concatenation testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 27] detailed listing: executing program 0: executing program 3: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) r10 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f0000000100)='br_fdb_external_learn_add\x00', r10}, 0x18) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 26] detailed listing: executing program 0: executing program 3: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00'}, 0x90) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 25] detailed listing: executing program 0: executing program 3: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r8 = socket$inet(0x10, 0x4, 0x2) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r9, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000300)={'bond0\x00'}) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 24] detailed listing: executing program 0: executing program 3: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) socket$inet(0x10, 0x4, 0x2) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_opts(r8, 0x0, 0xd, &(0x7f0000000940)='C', 0x1) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 23] detailed listing: executing program 0: executing program 3: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) socket$inet(0x10, 0x4, 0x2) socket$inet_tcp(0x2, 0x1, 0x0) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 22] detailed listing: executing program 0: executing program 3: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) socket$inet(0x10, 0x4, 0x2) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 21] detailed listing: executing program 0: executing program 3: executing program 0: r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r2, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r3 = socket$pppl2tp(0x18, 0x1, 0x1) r4 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r3, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r4, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r3) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r3, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r5, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r6, 0x8914, &(0x7f0000000000)) r7 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r7, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) program crashed: KASAN: use-after-free Read in ax25_release testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 20] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0xfffffffffffffe1d) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 19] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) ioctl$sock_netrom_SIOCADDRT(0xffffffffffffffff, 0x890b, &(0x7f0000000000)={0x0, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bpq0, 0x1, 'syz1\x00', @default, 0x1, 0x0, [@null, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @default]}) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 18] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 17] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) syz_init_net_socket$ax25(0x3, 0x2, 0xcc) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 17] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 17] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 17] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r5 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r5, 0x8914, &(0x7f0000000000)) r6 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r6, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 17] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r4, 0x80487436, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(0xffffffffffffffff, 0x8914, &(0x7f0000000000)) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 17] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r0 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r0, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r1, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r2, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r1) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) r3 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r1, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$PPPIOCGL2TPSTATS(r3, 0x80487436, 0x0) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 17] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r2, &(0x7f0000000040)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x2, 0x3, 0xfffffffd, 0x3, {0xa, 0x4e24, 0x3, @loopback, 0x3}}}, 0x3a) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 16] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) socket$pppl2tp(0x18, 0x1, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 15] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000540)={{{@in, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0xa}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800}}, {{@in=@multicast2, 0x0, 0x32}, 0x0, @in=@local}}, 0xe8) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 14] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) close(r2) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 13] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) r2 = socket$pppl2tp(0x18, 0x1, 0x1) r3 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r2, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r3, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r4, 0x8914, &(0x7f0000000000)) r5 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r5, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 12] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 11] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) socket$pppl2tp(0x18, 0x1, 0x1) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 10] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) bind$ax25(r1, &(0x7f0000000100)={{0x3, @default, 0x1}, [@null, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @bcast, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null]}, 0x48) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r2, 0x8914, &(0x7f0000000000)) r3 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r3, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 9] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) syz_init_net_socket$ax25(0x3, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 8] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 7] detailed listing: executing program 0: executing program 3: executing program 0: syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 0, 7] detailed listing: executing program 0: executing program 3: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb minimized 28 calls -> 7 calls testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb bisect: concatenation succeeded found reproducer with 7 syscalls minimizing guilty program testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25 detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) syz_init_net_socket$ax25(0x3, 0x2, 0xcc) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(0xffffffffffffffff, 0x8914, &(0x7f0000000000)) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r0, 0x8914, &(0x7f0000000000)) r1 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r1, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, 0x0) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, 0x0, 0x0) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, 0x0) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program did not crash testing program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, 0x0, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=45s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb simplifying C reproducer testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program did not crash testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing compiled C program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE program crashed: KASAN: use-after-free Read in ax25_fillin_cb testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb validation run: crashed=true testing program (duration=45s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socketpair$unix-ioctl$sock_SIOCGIFINDEX-syz_init_net_socket$bt_sco-setsockopt$ax25_SO_BINDTODEVICE-ioctl$sock_netdev_private-syz_init_net_socket$ax25-setsockopt$ax25_SO_BINDTODEVICE detailed listing: executing program 0: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00'}) r1 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ax25_SO_BINDTODEVICE(0xffffffffffffffff, 0x101, 0x19, &(0x7f0000000000)=@bpq0, 0x10) ioctl$sock_netdev_private(r1, 0x8914, &(0x7f0000000000)) r2 = syz_init_net_socket$ax25(0x3, 0x2, 0xcc) setsockopt$ax25_SO_BINDTODEVICE(r2, 0x101, 0x19, &(0x7f00000001c0)=@bpq0, 0x10) program crashed: KASAN: use-after-free Read in ax25_fillin_cb validation run: crashed=true reproducing took 3h5m5.421718832s repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] BUG: KASAN: use-after-free in ax25_fillin_cb+0x394/0x568 net/ax25/af_ax25.c:495 Read of size 4 at addr ffff0000c7e3de38 by task syz.0.18/4156 CPU: 0 PID: 4156 Comm: syz.0.18 Not tainted 5.15.186-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call trace: dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 print_address_description+0x78/0x30c mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xec/0x15c mm/kasan/report.c:451 __asan_report_load4_noabort+0x44/0x50 mm/kasan/report_generic.c:308 ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] ax25_fillin_cb+0x394/0x568 net/ax25/af_ax25.c:495 ax25_setsockopt+0x8d0/0xa5c net/ax25/af_ax25.c:690 __sys_setsockopt+0x2f8/0x4b0 net/socket.c:2203 __do_sys_setsockopt net/socket.c:2214 [inline] __se_sys_setsockopt net/socket.c:2211 [inline] __arm64_sys_setsockopt+0xb8/0xd4 net/socket.c:2211 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Allocated by task 4153: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xb0/0xf0 mm/kasan/common.c:522 kasan_kmalloc include/linux/kasan.h:264 [inline] kmem_cache_alloc_trace+0x274/0x3fc mm/slub.c:3247 kmalloc include/linux/slab.h:604 [inline] kzalloc include/linux/slab.h:735 [inline] ax25_dev_device_up+0x5c/0x540 net/ax25/ax25_dev.c:55 ax25_device_event+0x504/0x590 net/ax25/af_ax25.c:139 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:391 call_netdevice_notifiers_info net/core/dev.c:2049 [inline] call_netdevice_notifiers_extack net/core/dev.c:2061 [inline] call_netdevice_notifiers net/core/dev.c:2075 [inline] __dev_notify_flags+0x250/0x46c net/core/dev.c:-1 dev_change_flags+0xc8/0x154 net/core/dev.c:8929 dev_ifsioc+0x504/0xef4 net/core/dev_ioctl.c:324 dev_ioctl+0x4d0/0xc94 net/core/dev_ioctl.c:587 sock_do_ioctl+0x18c/0x240 net/socket.c:1154 sock_ioctl+0x5c8/0x87c net/socket.c:1257 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Freed by task 4154: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4c/0x84 mm/kasan/common.c:46 kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360 ____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1705 [inline] slab_free_freelist_hook+0x128/0x1e8 mm/slub.c:1731 slab_free mm/slub.c:3499 [inline] kfree+0x170/0x40c mm/slub.c:4559 ax25_dev_put include/net/ax25.h:302 [inline] ax25_release+0x564/0x814 net/ax25/af_ax25.c:1062 __sock_release net/socket.c:649 [inline] sock_close+0xb4/0x1f8 net/socket.c:1336 __fput+0x1c0/0x7f8 fs/file_table.c:311 ____fput+0x20/0x30 fs/file_table.c:339 task_work_run+0x12c/0x1e0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x24b4/0x3128 arch/arm64/kernel/signal.c:949 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xf0/0x1e0 arch/arm64/kernel/entry-common.c:609 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Last potentially related work creation: kasan_save_stack+0x38/0x68 mm/kasan/common.c:38 kasan_record_aux_stack+0xcc/0x114 mm/kasan/generic.c:348 insert_work+0x64/0x388 kernel/workqueue.c:1366 __queue_work+0xb30/0x1054 kernel/workqueue.c:1532 queue_work_on+0xc4/0x17c kernel/workqueue.c:1559 queue_work include/linux/workqueue.h:512 [inline] call_usermodehelper_exec+0x22c/0x478 kernel/umh.c:435 kobject_uevent_env+0x670/0x888 lib/kobject_uevent.c:633 kobject_uevent+0x2c/0x3c lib/kobject_uevent.c:657 driver_register+0x29c/0x374 drivers/base/driver.c:248 __platform_driver_register+0x6c/0x80 drivers/base/platform.c:858 es7134_driver_init+0x20/0x2c sound/soc/codecs/es7134.c:313 do_one_initcall+0x228/0x8b0 init/main.c:1302 do_initcall_level+0x154/0x214 init/main.c:1375 do_initcalls+0x58/0xac init/main.c:1391 do_basic_setup+0x8c/0xa0 init/main.c:1410 kernel_init_freeable+0x404/0x5fc init/main.c:1615 kernel_init+0x24/0x1d0 init/main.c:1506 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855 The buggy address belongs to the object at ffff0000c7e3de00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 56 bytes inside of 256-byte region [ffff0000c7e3de00, ffff0000c7e3df00) The buggy address belongs to the page: page:00000000dbf7a57b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107e3c head:00000000dbf7a57b order:1 compound_mapcount:0 flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002480 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000c7e3dd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000c7e3dd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000c7e3de00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000c7e3de80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000c7e3df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Unable to handle kernel paging request at virtual address 00600300000015e2 Mem abort info: ESR = 0x0000000096000021 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault Data abort info: ISV = 0, ISS = 0x00000021 CM = 0, WnR = 0 [00600300000015e2] address between user and kernel address ranges Internal error: Oops: 0000000096000021 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 4156 Comm: syz.0.18 Tainted: G B 5.15.186-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __lse_atomic_fetch_sub_release arch/arm64/include/asm/atomic_lse.h:161 [inline] pc : arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline] pc : atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:168 [inline] pc : __refcount_dec include/linux/refcount.h:338 [inline] pc : refcount_dec include/linux/refcount.h:359 [inline] pc : dev_put include/linux/netdevice.h:4197 [inline] pc : ax25_release+0x4f4/0x814 net/ax25/af_ax25.c:1061 lr : __lse_atomic_fetch_sub_release arch/arm64/include/asm/atomic_lse.h:161 [inline] lr : arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline] lr : atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:168 [inline] lr : __refcount_dec include/linux/refcount.h:338 [inline] lr : refcount_dec include/linux/refcount.h:359 [inline] lr : dev_put include/linux/netdevice.h:4197 [inline] lr : ax25_release+0x4ec/0x814 net/ax25/af_ax25.c:1061 sp : ffff80001f687a00 x29: ffff80001f687a20 x28: dfff800000000000 x27: ffff0000d6dfc080 x26: ffff0000d6de8828 x25: 0000000000000002 x24: 00000000ffffffff x23: a6600300000015e2 x22: ffff0000c7e3de00 x21: ffff0000dca99818 x20: ffff0000d6dfc000 x19: 1fffe0001adbd105 x18: 0000000000000000 x17: 0000000000000000 x16: ffff8000082d6448 x15: 0000000000000002 x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000ff0100 x11: 0000000000000000 x10: 0000000000000000 x9 : ffff8000104555f4 x8 : ffff0000ce7cb680 x7 : 0000000000000000 x6 : ffff80000837b9b0 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000104555e8 x2 : 0000000000000001 x1 : 0000000000000004 x0 : 0000000000000001 Call trace: __lse_atomic_fetch_sub_release arch/arm64/include/asm/atomic_lse.h:161 [inline] arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline] atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:168 [inline] __refcount_dec include/linux/refcount.h:338 [inline] refcount_dec include/linux/refcount.h:359 [inline] dev_put include/linux/netdevice.h:4197 [inline] ax25_release+0x4f4/0x814 net/ax25/af_ax25.c:1061 __sock_release net/socket.c:649 [inline] sock_close+0xb4/0x1f8 net/socket.c:1336 __fput+0x1c0/0x7f8 fs/file_table.c:311 ____fput+0x20/0x30 fs/file_table.c:339 task_work_run+0x12c/0x1e0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x24b4/0x3128 arch/arm64/kernel/signal.c:949 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xf0/0x1e0 arch/arm64/kernel/entry-common.c:609 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Code: d503201f 9600931b 52800038 4b1803f8 (b87802f8) ---[ end trace 38af9434d2f51416 ]--- ---------------- Code disassembly (best guess): 0: d503201f nop 4: 9600931b bl 0xfffffffff8024c70 8: 52800038 mov w24, #0x1 // #1 c: 4b1803f8 neg w24, w24 * 10: b87802f8 ldaddl w24, w24, [x23] <-- trapping instruction final repro crashed as (corrupted=false): ================================================================== BUG: KASAN: use-after-free in ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] BUG: KASAN: use-after-free in ax25_fillin_cb+0x394/0x568 net/ax25/af_ax25.c:495 Read of size 4 at addr ffff0000c7e3de38 by task syz.0.18/4156 CPU: 0 PID: 4156 Comm: syz.0.18 Not tainted 5.15.186-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 Call trace: dump_backtrace+0x0/0x43c arch/arm64/kernel/stacktrace.c:152 show_stack+0x2c/0x3c arch/arm64/kernel/stacktrace.c:216 __dump_stack+0x30/0x40 lib/dump_stack.c:88 dump_stack_lvl+0xf8/0x160 lib/dump_stack.c:106 print_address_description+0x78/0x30c mm/kasan/report.c:248 __kasan_report mm/kasan/report.c:434 [inline] kasan_report+0xec/0x15c mm/kasan/report.c:451 __asan_report_load4_noabort+0x44/0x50 mm/kasan/report_generic.c:308 ax25_fillin_cb_from_dev net/ax25/af_ax25.c:468 [inline] ax25_fillin_cb+0x394/0x568 net/ax25/af_ax25.c:495 ax25_setsockopt+0x8d0/0xa5c net/ax25/af_ax25.c:690 __sys_setsockopt+0x2f8/0x4b0 net/socket.c:2203 __do_sys_setsockopt net/socket.c:2214 [inline] __se_sys_setsockopt net/socket.c:2211 [inline] __arm64_sys_setsockopt+0xb8/0xd4 net/socket.c:2211 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Allocated by task 4153: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track mm/kasan/common.c:46 [inline] set_alloc_info mm/kasan/common.c:434 [inline] ____kasan_kmalloc mm/kasan/common.c:513 [inline] __kasan_kmalloc+0xb0/0xf0 mm/kasan/common.c:522 kasan_kmalloc include/linux/kasan.h:264 [inline] kmem_cache_alloc_trace+0x274/0x3fc mm/slub.c:3247 kmalloc include/linux/slab.h:604 [inline] kzalloc include/linux/slab.h:735 [inline] ax25_dev_device_up+0x5c/0x540 net/ax25/ax25_dev.c:55 ax25_device_event+0x504/0x590 net/ax25/af_ax25.c:139 notifier_call_chain kernel/notifier.c:83 [inline] raw_notifier_call_chain+0xd4/0x164 kernel/notifier.c:391 call_netdevice_notifiers_info net/core/dev.c:2049 [inline] call_netdevice_notifiers_extack net/core/dev.c:2061 [inline] call_netdevice_notifiers net/core/dev.c:2075 [inline] __dev_notify_flags+0x250/0x46c net/core/dev.c:-1 dev_change_flags+0xc8/0x154 net/core/dev.c:8929 dev_ifsioc+0x504/0xef4 net/core/dev_ioctl.c:324 dev_ioctl+0x4d0/0xc94 net/core/dev_ioctl.c:587 sock_do_ioctl+0x18c/0x240 net/socket.c:1154 sock_ioctl+0x5c8/0x87c net/socket.c:1257 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:874 [inline] __se_sys_ioctl fs/ioctl.c:860 [inline] __arm64_sys_ioctl+0x14c/0x1c8 fs/ioctl.c:860 __invoke_syscall arch/arm64/kernel/syscall.c:38 [inline] invoke_syscall+0x98/0x2b8 arch/arm64/kernel/syscall.c:52 el0_svc_common+0x138/0x258 arch/arm64/kernel/syscall.c:142 do_el0_svc+0x58/0x14c arch/arm64/kernel/syscall.c:181 el0_svc+0x78/0x1e0 arch/arm64/kernel/entry-common.c:608 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Freed by task 4154: kasan_save_stack mm/kasan/common.c:38 [inline] kasan_set_track+0x4c/0x84 mm/kasan/common.c:46 kasan_set_free_info+0x28/0x4c mm/kasan/generic.c:360 ____kasan_slab_free+0x118/0x164 mm/kasan/common.c:366 __kasan_slab_free+0x18/0x28 mm/kasan/common.c:374 kasan_slab_free include/linux/kasan.h:230 [inline] slab_free_hook mm/slub.c:1705 [inline] slab_free_freelist_hook+0x128/0x1e8 mm/slub.c:1731 slab_free mm/slub.c:3499 [inline] kfree+0x170/0x40c mm/slub.c:4559 ax25_dev_put include/net/ax25.h:302 [inline] ax25_release+0x564/0x814 net/ax25/af_ax25.c:1062 __sock_release net/socket.c:649 [inline] sock_close+0xb4/0x1f8 net/socket.c:1336 __fput+0x1c0/0x7f8 fs/file_table.c:311 ____fput+0x20/0x30 fs/file_table.c:339 task_work_run+0x12c/0x1e0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x24b4/0x3128 arch/arm64/kernel/signal.c:949 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xf0/0x1e0 arch/arm64/kernel/entry-common.c:609 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Last potentially related work creation: kasan_save_stack+0x38/0x68 mm/kasan/common.c:38 kasan_record_aux_stack+0xcc/0x114 mm/kasan/generic.c:348 insert_work+0x64/0x388 kernel/workqueue.c:1366 __queue_work+0xb30/0x1054 kernel/workqueue.c:1532 queue_work_on+0xc4/0x17c kernel/workqueue.c:1559 queue_work include/linux/workqueue.h:512 [inline] call_usermodehelper_exec+0x22c/0x478 kernel/umh.c:435 kobject_uevent_env+0x670/0x888 lib/kobject_uevent.c:633 kobject_uevent+0x2c/0x3c lib/kobject_uevent.c:657 driver_register+0x29c/0x374 drivers/base/driver.c:248 __platform_driver_register+0x6c/0x80 drivers/base/platform.c:858 es7134_driver_init+0x20/0x2c sound/soc/codecs/es7134.c:313 do_one_initcall+0x228/0x8b0 init/main.c:1302 do_initcall_level+0x154/0x214 init/main.c:1375 do_initcalls+0x58/0xac init/main.c:1391 do_basic_setup+0x8c/0xa0 init/main.c:1410 kernel_init_freeable+0x404/0x5fc init/main.c:1615 kernel_init+0x24/0x1d0 init/main.c:1506 ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:855 The buggy address belongs to the object at ffff0000c7e3de00 which belongs to the cache kmalloc-256 of size 256 The buggy address is located 56 bytes inside of 256-byte region [ffff0000c7e3de00, ffff0000c7e3df00) The buggy address belongs to the page: page:00000000dbf7a57b refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x107e3c head:00000000dbf7a57b order:1 compound_mapcount:0 flags: 0x5ffc00000010200(slab|head|node=0|zone=2|lastcpupid=0x7ff) raw: 05ffc00000010200 dead000000000100 dead000000000122 ffff0000c0002480 raw: 0000000000000000 0000000000100010 00000001ffffffff 0000000000000000 page dumped because: kasan: bad access detected Memory state around the buggy address: ffff0000c7e3dd00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ffff0000c7e3dd80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc >ffff0000c7e3de00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ^ ffff0000c7e3de80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb ffff0000c7e3df00: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc ================================================================== Unable to handle kernel paging request at virtual address 00600300000015e2 Mem abort info: ESR = 0x0000000096000021 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 FSC = 0x21: alignment fault Data abort info: ISV = 0, ISS = 0x00000021 CM = 0, WnR = 0 [00600300000015e2] address between user and kernel address ranges Internal error: Oops: 0000000096000021 [#1] PREEMPT SMP Modules linked in: CPU: 1 PID: 4156 Comm: syz.0.18 Tainted: G B 5.15.186-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 pstate: 80400005 (Nzcv daif +PAN -UAO -TCO -DIT -SSBS BTYPE=--) pc : __lse_atomic_fetch_sub_release arch/arm64/include/asm/atomic_lse.h:161 [inline] pc : arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline] pc : atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:168 [inline] pc : __refcount_dec include/linux/refcount.h:338 [inline] pc : refcount_dec include/linux/refcount.h:359 [inline] pc : dev_put include/linux/netdevice.h:4197 [inline] pc : ax25_release+0x4f4/0x814 net/ax25/af_ax25.c:1061 lr : __lse_atomic_fetch_sub_release arch/arm64/include/asm/atomic_lse.h:161 [inline] lr : arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline] lr : atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:168 [inline] lr : __refcount_dec include/linux/refcount.h:338 [inline] lr : refcount_dec include/linux/refcount.h:359 [inline] lr : dev_put include/linux/netdevice.h:4197 [inline] lr : ax25_release+0x4ec/0x814 net/ax25/af_ax25.c:1061 sp : ffff80001f687a00 x29: ffff80001f687a20 x28: dfff800000000000 x27: ffff0000d6dfc080 x26: ffff0000d6de8828 x25: 0000000000000002 x24: 00000000ffffffff x23: a6600300000015e2 x22: ffff0000c7e3de00 x21: ffff0000dca99818 x20: ffff0000d6dfc000 x19: 1fffe0001adbd105 x18: 0000000000000000 x17: 0000000000000000 x16: ffff8000082d6448 x15: 0000000000000002 x14: 0000000000ff0100 x13: ffffffffffffffff x12: 0000000000ff0100 x11: 0000000000000000 x10: 0000000000000000 x9 : ffff8000104555f4 x8 : ffff0000ce7cb680 x7 : 0000000000000000 x6 : ffff80000837b9b0 x5 : 0000000000000000 x4 : 0000000000000000 x3 : ffff8000104555e8 x2 : 0000000000000001 x1 : 0000000000000004 x0 : 0000000000000001 Call trace: __lse_atomic_fetch_sub_release arch/arm64/include/asm/atomic_lse.h:161 [inline] arch_atomic_fetch_sub_release arch/arm64/include/asm/atomic.h:51 [inline] atomic_fetch_sub_release include/linux/atomic/atomic-instrumented.h:168 [inline] __refcount_dec include/linux/refcount.h:338 [inline] refcount_dec include/linux/refcount.h:359 [inline] dev_put include/linux/netdevice.h:4197 [inline] ax25_release+0x4f4/0x814 net/ax25/af_ax25.c:1061 __sock_release net/socket.c:649 [inline] sock_close+0xb4/0x1f8 net/socket.c:1336 __fput+0x1c0/0x7f8 fs/file_table.c:311 ____fput+0x20/0x30 fs/file_table.c:339 task_work_run+0x12c/0x1e0 kernel/task_work.c:188 tracehook_notify_resume include/linux/tracehook.h:189 [inline] do_notify_resume+0x24b4/0x3128 arch/arm64/kernel/signal.c:949 prepare_exit_to_user_mode arch/arm64/kernel/entry-common.c:133 [inline] exit_to_user_mode arch/arm64/kernel/entry-common.c:138 [inline] el0_svc+0xf0/0x1e0 arch/arm64/kernel/entry-common.c:609 el0t_64_sync_handler+0xcc/0xe4 arch/arm64/kernel/entry-common.c:626 el0t_64_sync+0x1a0/0x1a4 arch/arm64/kernel/entry.S:584 Code: d503201f 9600931b 52800038 4b1803f8 (b87802f8) ---[ end trace 38af9434d2f51416 ]--- ---------------- Code disassembly (best guess): 0: d503201f nop 4: 9600931b bl 0xfffffffff8024c70 8: 52800038 mov w24, #0x1 // #1 c: 4b1803f8 neg w24, w24 * 10: b87802f8 ldaddl w24, w24, [x23] <-- trapping instruction