Extracting prog: 5m55.975131406s
Minimizing prog: 29m12.88483599s
Simplifying prog options: 0s
Extracting C: 1m20.175359469s
Simplifying C: 7m51.920092971s


extracting reproducer from 31 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)

program did not crash
single: failed to extract reproducer
bisect: bisecting 31 programs with base timeout 30s
testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [10, 8, 9, 5, 10, 14, 14, 15, 18, 6, 15, 2, 10, 2, 9, 6, 6, 18, 9, 29, 5, 3, 4, 15, 6, 6, 10, 15, 3, 3, 7]
detailed listing:
executing program 3:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1})
ioctl$TUNSETNOCSUM(r0, 0x400454c8, 0x1)
r1 = socket$inet(0x2, 0x2, 0x0)
ioctl$sock_inet_SIOCSIFADDR(r1, 0x8916, &(0x7f0000000080)={'syzkaller0\x00', {0x2, 0x0, @rand_addr=0xac140001}})
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f00000000c0)={'syzkaller0\x00', 0x1})
r2 = socket$inet_sctp(0x2, 0x1, 0x84)
bind(r2, &(0x7f0000000000)=@in={0x2, 0x3210, @rand_addr=0xac140001}, 0x10)
listen(r2, 0x5)
write$tun(r0, &(0x7f0000000200)=ANY=[@ANYBLOB="010008004500003c000000004084ca2502020202ac14000104d2321000000000000000000100001c11223344000080000005000500000001c001000811223344"], 0x40)
executing program 3:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)={0x1c, 0x2, 0x3, 0x1, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x3, 0x0, 0x2}}]}, 0x1c}}, 0x0)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0x1c, 0x2, 0x3, 0x1, 0x0, 0x0, {0x2}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x2}}]}, 0x1c}}, 0x0)
sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x20, 0x2, 0x3, 0x1, 0x0, 0x0, {0x2}, [@NFQA_CFG_PARAMS={0x9, 0x2, {0xffff, 0x2}}]}, 0x20}}, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x88581, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syz_tun\x00', 0x2})
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=@dellink={0x34, 0x11, 0x1, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'syz_tun\x00'}]}, 0x34}}, 0x0)
executing program 3:
r0 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000000)={0x0, 0x1, 0x4, "1234"}, 0xc)
setsockopt$inet_sctp_SCTP_HMAC_IDENT(r0, 0x84, 0x16, &(0x7f0000000100)={0x1, [0x1]}, 0x8)
setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000200)=[@in={0x2, 0x4e21, @local}], 0x10)
listen(r0, 0x5)
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_AUTH_KEY(r1, 0x84, 0x17, &(0x7f0000000300)={0x0, 0x1, 0x4, "1234"}, 0xc)
setsockopt$inet_sctp_SCTP_HMAC_IDENT(r1, 0x84, 0x16, &(0x7f0000000400)={0x1, [0x1]}, 0x8)
connect$inet(r1, &(0x7f0000000500)={0x2, 0x4e21, @local}, 0x10)
executing program 3:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@newsa={0x154, 0x10, 0x5, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2}, {@in=@loopback, 0x1234, 0x32}, @in=@loopback, {}, {}, {}, 0x1, 0x2, 0x2}, [@algo_crypt={0x58, 0x6, {{'cbc(aes)\x00'}, 0x80, "000102030405060708090a0b0c0d0e0f"}}, @offload={0xc, 0x11, {0x1}}]}, 0x154}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000300)=@newpolicy={0xfc, 0x13, 0x5, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x13, [{{@in=@loopback, 0x1234, 0x32}, 0x2, @in=@loopback, 0x2}]}]}, 0xfc}}, 0x0)
r1 = socket$inet_udp(0x2, 0x2, 0x0)
sendto$inet(r1, &(0x7f0000000400)="01020304", 0x4, 0x0, &(0x7f0000000440)={0x2, 0x1234, @loopback}, 0x10)
executing program 3:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000100)='./sys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/netdevsim/new_device\x00', 0x801, 0x0)
write(r0, &(0x7f0000000400)='10 2\n', 0x5)
close(r0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./sys/bus/netdevsim/devices/netdevsim10/sriov_numvfs\x00', 0x801, 0x0)
write(r1, &(0x7f0000000600)='120\n', 0x4)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000900)=ANY=[@ANYBLOB="340000001200010001000000000000000000000000000000000000000000000009000300657468310000000008001d0001000000"], 0x34}}, 0x0)
executing program 3:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00', 0x1})
bind$inet(r1, &(0x7f0000000400)={0x2, 0x4e21, @loopback}, 0x10)
listen(r1, 0x10)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000500)={0x2, 0x4e21, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000b00)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000e00)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 32:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000001c0)={0x38, 0x1403, 0x1, 0x0, 0x0, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'lo\x00'}}]}, 0x38}}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
r1 = socket$inet_smc(0x2b, 0x1, 0x0)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000000)={'lo\x00', 0x1})
bind$inet(r1, &(0x7f0000000400)={0x2, 0x4e21, @loopback}, 0x10)
listen(r1, 0x10)
r2 = socket$inet_smc(0x2b, 0x1, 0x0)
connect$inet(r2, &(0x7f0000000500)={0x2, 0x4e21, @loopback}, 0x10)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000800)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000b00)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x1}]}, 0x18}}, 0x0)
sendmsg$RDMA_NLDEV_CMD_DELLINK(r0, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000e00)={0x18, 0x1404, 0x1, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8, 0x1, 0x2}]}, 0x18}}, 0x0)
nanosleep(&(0x7f0000000300)={0x1}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ed)
mount(0x0, &(0x7f0000000080)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/sys/net/sctp/intl_enable\x00', 0x1, 0x0)
write(r0, 0x0, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000120)='./proc/sys/net/sctp/reconf_enable\x00', 0x1, 0x0)
write(r1, &(0x7f0000000140)='1\x00', 0x1)
close(r1)
r2 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt(r2, 0x84, 0x7d, &(0x7f0000000200)="0000000001000000", 0x8)
r3 = socket$inet_sctp(0x2, 0x1, 0x84)
setsockopt$inet_sctp_SCTP_FRAGMENT_INTERLEAVE(r3, 0x84, 0x12, &(0x7f00000002c0)=0x2, 0x4)
setsockopt(r3, 0x84, 0x7d, &(0x7f0000000300)="0000000001000000", 0x8)
bind(r2, &(0x7f00000003c0)=@in={0x2, 0x4e20, @loopback}, 0x10)
listen(r2, 0x5)
connect(r3, &(0x7f0000000400)=@in={0x2, 0x4e20, @loopback}, 0x10)
executing program 1:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=@newqdisc={0x44, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10}}]}}]}, 0x44}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000300)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x3e8, 0xa, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000700)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x3e8, 0xa, 0x64, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000880)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000ec0)={0x0}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f00000010c0)={&(0x7f0000001100)=@newqdisc={0x6c, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x3c, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x3e8, 0xa, 0x64, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1}}]}}]}, 0x6c}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000001480)={0x0, 0x0, &(0x7f00000014c0)={&(0x7f0000001500)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x3e8, 0xa, 0x64, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000001680)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000001880)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000001a80)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x3e8, 0xa, 0x64, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000001c80)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000001e80)={0x0, 0x0, &(0x7f0000001ec0)={0x0}}, 0x0)
sendmsg$nl_route_sched(r0, 0x0, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000002280)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000002380)={0x0, 0x0, &(0x7f00000023c0)={&(0x7f0000002400)=@newqdisc={0x170, 0x24, 0x405, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x140, 0x2, [@TCA_GRED_PARMS={0x38, 0x1, {0x3e8, 0xa, 0x64, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x1, 0x1}}, @TCA_GRED_STAB={0x104}]}}]}, 0x170}}, 0x0)
sendmsg$nl_route_sched(r0, &(0x7f0000002580)={0x0, 0x0, &(0x7f00000025c0)={&(0x7f0000002600)=@getqdisc={0x24, 0x26, 0x301}, 0x24}}, 0x0)
executing program 1:
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/threads\x00', 0x2, 0x0)
write(r0, &(0x7f00000000c0)='8\n\x00', 0x2)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./nfsd/portlist\x00', 0x2, 0x0)
write(r1, &(0x7f0000000140)='2049\n\x00', 0x5)
executing program 0:
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8192, 0x2000, 0x800}, 0x20)
setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4)
setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00'})
mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000)
pipe2(&(0x7f0000000400)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
write(r3, &(0x7f0000000500)="01000000", 0x4)
read(r2, &(0x7f0000000000), 0x4)
write(r3, &(0x7f0000000600)='\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00', 0x10)
read(r2, &(0x7f0000000140), 0x10)
sendmsg$xdp(r0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x40)
ppoll(&(0x7f0000000800)=[{r0, 0x4}], 0x1, 0x0, 0x0, 0x0)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000020)={&(0x7f0000000040)={0x1c, 0x10, 0x1, 0x0, 0x0, {0x1}}, 0x1c}}, 0x0)
executing program 2:
r0 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r0, &(0x7f0000000000)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24)
listen(r0, 0x5)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
sendmsg(r1, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000250)='hello', 0x5}], 0x1, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0)
nanosleep(&(0x7f0000000400)={0x0, 0x5f5e100}, 0x0)
sendmsg(r1, &(0x7f0000000100)={&(0x7f0000000080)=@rxrpc=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x80, &(0x7f0000000200)=[{&(0x7f0000000250)='abort', 0x5}], 0x1, &(0x7f0000000300)=[{0x18, 0x110, 0x1, "0100000000000000"}, {0x18, 0x10f, 0x1, "0100000000000000"}], 0x30}, 0x0)
shutdown(r0, 0x2)
close(r0)
nanosleep(&(0x7f0000000400)={0xb}, 0x0)
executing program 4:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_MSG_GETGEN(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)={0x14, 0x10, 0xa, 0x0, 0x0, 0x0, {0xa}}, 0x14}}, 0x0)
executing program 0:
r0 = socket$inet(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x6f, @loopback}, 0x10)
r1 = fsopen(&(0x7f0000000100)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000200)='vers\x00', &(0x7f0000000240)='4.0\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000280)='addr\x00', &(0x7f00000002c0)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000300)='source\x00', &(0x7f0000000340)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000380)='proto\x00', &(0x7f00000003c0)='tcp\x00', 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) (async)
recvfrom$inet(r0, &(0x7f0000000500)=""/100, 0x64, 0x40, &(0x7f0000000600)={0x2, 0x0, @empty}, 0x10)
executing program 4:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ed)
mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f0000000b00)='./proc/net/rpc/auth.unix.ip/content\x00', 0x0, 0x0)
read(r1, &(0x7f0000000c00)=""/4096, 0x1000)
executing program 4:
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket$inet(0x2, 0x2, 0x0)
sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x50, 0x10, 0x601, 0x0, 0x0, {}, [@IFLA_IFNAME={0x14, 0x3, 'veth0\x00'}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x4}, @IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}]}, 0x50}}, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000300)={'veth0\x00', <r2=>0x0})
sendmsg$nl_route_sched(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)=@newqdisc={0xc0, 0x24, 0x601, 0x0, 0x0, {0x0, 0x0, 0x0, r2, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x90, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [], 0x0, [0x4]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x20, 0x2, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_CMD={0x5}, @TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x1}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x3e8}]}]}, @TCA_TAPRIO_ATTR_SCHED_BASE_TIME={0xc}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8}]}}]}, 0xc0}}, 0x0)
nanosleep(&(0x7f0000000600)={0x0, 0x5f5e100}, 0x0)
executing program 2:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff)
sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x24, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_SUBFLOWS={0x8, 0x3, 0x8}]}, 0x24}}, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./proc\x00', 0x1ff)
mount(0x0, &(0x7f0000000200)='./proc\x00', &(0x7f0000000240)='proc\x00', 0x0, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000280)='./proc/sys/net/mptcp/add_addr_timeout\x00', 0x1, 0x0)
write(r2, &(0x7f00000002c0)='1\n\x00', 0x2)
r3 = socket$inet_mptcp(0x2, 0x1, 0x106)
bind$inet(r3, &(0x7f0000000300)={0x2, 0x1f40, @loopback}, 0x10)
listen(r3, 0x5)
r4 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r4, &(0x7f0000000300)={0x2, 0x1f40, @loopback}, 0x10)
r5 = accept(r3, 0x0, 0x0)
write(r4, &(0x7f0000000400)="0123456789", 0xa)
read(r5, &(0x7f0000000500), 0xa)
sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x38, r1, 0x1, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x24, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @private=0xa010100}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x2}]}]}, 0x38}}, 0x0)
read(r4, &(0x7f0000000600), 0x100)
nanosleep(&(0x7f0000000700)={0x3}, 0x0)
executing program 0:
r0 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @local, 0x1}, 0x1c)
listen(r0, 0x5)
r1 = socket$inet6_tcp(0xa, 0x1, 0x0)
connect$inet6(r1, &(0x7f0000000100)={0xa, 0x4e22, 0x0, @local, 0x1}, 0x1c)
r2 = accept4$inet6(r0, 0x0, 0x0, 0x0)
write(r1, &(0x7f0000000200)='hello', 0x5)
write(r2, &(0x7f0000000240)='world', 0x5)
syz_emit_ethernet(0x4a, &(0x7f0000000300)={@local, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00', 0x14, 0x6, 0x40, @remote, @local, {[], {{0x4e22, 0x4e22, 0x0, 0x0, 0x0, 0x0, 0x5, 0x18, 0x1000}}}}}}}, 0x0)
executing program 1:
r0 = socket$inet(0x2, 0x1, 0x0)
bind$inet(r0, &(0x7f0000000200)={0x2, 0x801, @empty}, 0x10)
getsockname(r0, &(0x7f0000000104), &(0x7f0000000120)=0x10)
r1 = socket$inet(0x2, 0x1, 0x0)
bind$inet(r1, &(0x7f0000000000)={0x2, 0x801, @loopback}, 0x10)
listen(r1, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000001400)='./mnt\x00', 0x1ff)
r2 = fsopen(&(0x7f0000000400)='nfs\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000500)='source\x00', &(0x7f0000000600)='127.0.0.1:/export\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000700)='addr\x00', &(0x7f0000000800)='127.0.0.1\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000900)='nfsvers\x00', &(0x7f0000000a00)='3\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000b00)='proto\x00', &(0x7f0000000c00)='tcp\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000d00)='port\x00', &(0x7f0000000e00)='2049\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000000f00)='mountport\x00', &(0x7f0000001000)='2049\x00', 0x0)
fsconfig$FSCONFIG_SET_STRING(r2, 0x1, &(0x7f0000001100)='mountproto\x00', &(0x7f0000001200)='tcp\x00', 0x0)
fsconfig$FSCONFIG_SET_FLAG(r2, 0x0, &(0x7f0000001300)='ro\x00', 0x0, 0x0)
syz_clone(0x511, 0x0, 0x0, 0x0, 0x0, 0x0)
fsconfig$FSCONFIG_CMD_CREATE(r2, 0x6, 0x0, 0x0, 0x0)
mount$nfs(&(0x7f0000000500)='127.0.0.1:/export\x00', &(0x7f0000001400)='./mnt\x00', &(0x7f0000000400), 0x0, &(0x7f0000000600)=ANY=[@ANYBLOB='addr=127.0.0.1,nfsvers=3,proto=tcp,port=2049,mountport=2049,nolock\x00'])
r3 = accept4$inet(r1, 0x0, 0x0, 0x0)
recvfrom$inet(r3, &(0x7f0000000100)=""/8, 0x8, 0x0, 0x0, 0x0)
write(r3, &(0x7f0000000100), 0x40)
recvfrom$inet(r3, &(0x7f0000000100)=""/8, 0x8, 0x0, 0x0, 0x0)
write(r3, &(0x7f0000000100), 0x40)
recvfrom$inet(r3, &(0x7f0000000100)=""/8, 0x8, 0x0, 0x0, 0x0)
write(r3, &(0x7f0000000100), 0x40)
r4 = fsmount(r2, 0x0, 0x0)
move_mount(r4, &(0x7f0000001500)='\x00', 0xffffffffffffff9c, &(0x7f0000001400)='./mnt\x00', 0x4)
getxattr(&(0x7f0000001400)='./mnt/file\x00', &(0x7f0000001600)=@known='system.posix_acl_access\x00', &(0x7f0000001700)=""/256, 0x100)
executing program 4:
r0 = syz_init_net_socket$llc(0x1a, 0x801, 0x0)
setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000040)='lo\x00', 0x3)
bind$llc(r0, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x10)
connect$llc(r0, &(0x7f0000000100)={0x1a, 0x1, 0x0, 0x0, 0x0, 0x2}, 0x10)
syz_emit_ethernet(0x13, &(0x7f0000000080)={@empty, @empty, @void, {@llc={0x4, {@llc={0x2, 0x2, "020253"}}}}}, 0x0)
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x1a4, 0x10, 0x32, 0x0, 0x0, {{@in=@private=0xa010101, @in=@private=0xa010102, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20, 0x32}, {@in=@private=0xa010101, 0x1234, 0x32}, @in=@private=0xa010102, {}, {}, {}, 0x0, 0x0, 0x2}, [@algo_auth={0x28, 0x1, {{'hmac(sha1)\x00'}, 0x80, '\x00'/20}}, @algo_crypt={0x28, 0x2, {{'cbc(aes)\x00'}, 0x80, '\x00'/16}}]}, 0x1a4}}, 0x0)
sendmsg$netlink(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="940000002900010000000000000000000a01010100000000000000000000000034120000020032000a0101030000000000000000000000000a01010400000000000000000000000000000000000000000a0101010000000000000000000000000a010102000000000000000000000000000000000000020020203200000000000000000000000000020002000000"], 0x94}], 0x1}, 0x0)
executing program 2:
r0 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000000c0)=@bpf_tracing={0x1a, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
r1 = bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000300)={r0, 0x0, 0x1c, 0x0, @val=@iter={&(0x7f0000000400)=@cgroup={0x0, 0x0}, 0x10}}, 0x40)
r2 = bpf$ITER_CREATE(0x21, &(0x7f0000000500)={r1}, 0x8)
read(r2, &(0x7f0000000600), 0x100)
executing program 4:
r0 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r0, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000100000)=""/8192, 0x2000, 0x800}, 0x20)
setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x10, 0x4)
setsockopt$XDP_UMEM_COMPLETION_RING(r0, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4)
setsockopt$XDP_UMEM_FILL_RING(r0, 0x11b, 0x5, &(0x7f0000000140)=0x10, 0x4)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, <r1=>0xffffffffffffffff})
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00'})
mmap$xdp(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x3, 0x11, r0, 0x80000000)
pipe2(&(0x7f0000000400)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
write(r3, &(0x7f0000000500)="01000000", 0x4)
read(r2, &(0x7f0000000000), 0x4)
write(r3, &(0x7f0000000600)='\x00\x00\x00\x00\x00\x00\x00\x00@\x00\x00\x00\x00\x00\x00\x00', 0x10)
read(r2, &(0x7f0000000140), 0x10)
sendmsg$xdp(r0, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x40)
ppoll(&(0x7f0000000800)=[{r0, 0x4}], 0x1, 0x0, 0x0, 0x0)
executing program 0:
r0 = socket$inet_mptcp(0x2, 0x1, 0x106)
bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e22, @loopback}, 0x10)
listen(r0, 0x5)
r1 = socket$inet_mptcp(0x2, 0x1, 0x106)
connect$inet(r1, &(0x7f0000000100)={0x2, 0x4e22, @loopback}, 0x10)
setsockopt$inet_int(r1, 0x0, 0xf, &(0x7f0000000200)=0x1, 0x4)
executing program 2:
mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ed)
mount(&(0x7f0000000200)=@filename='none\x00', &(0x7f0000000300)='./proc\x00', &(0x7f0000000400)='proc\x00', 0x0, 0x0)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000600)=[{0x0}], 0x1}, 0x0)
r1 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0)
read(r1, &(0x7f0000000c00)=""/4096, 0x1000)
executing program 1:
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = socket$xdp(0x2c, 0x3, 0x0)
setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f0000000340)={&(0x7f0000000000)=""/65536, 0x10000, 0x800}, 0x20)
setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f0000000080)=0x10, 0x4)
setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000080)=0x10, 0x4)
setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000300)=0x10, 0x4)
ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000040)={'batadv_slave_0\x00', <r2=>0x0})
bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x2, r2, 0x0, 0x0}, 0x10)
mmap$xdp(0x0, 0x1000, 0x3, 0x11, r1, 0x80000000)
sendmsg$xdp(r1, &(0x7f0000000200), 0x40)
executing program 4:
r0 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r0, &(0x7f0000000000)={0x2, 0x4321, @loopback}, 0x10)
r1 = socket$rxrpc(0x21, 0x2, 0x2)
bind$rxrpc(r1, &(0x7f0000000040)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x1234, @loopback}}, 0x24)
connect$rxrpc(r1, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4321, @loopback}}, 0x24)
sendmsg(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000180)='hello\x00', 0x6}], 0x1, &(0x7f0000000200)=[{0x18, 0x110, 0x1, "0100000000000000"}], 0x18}, 0x0)
recvfrom(r0, &(0x7f0000000300), 0x100, 0x0, 0x0, 0x0)
pipe2(&(0x7f0000000400)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff}, 0x0)
write(r3, &(0x7f0000000500)="0200", 0x2)
read(r2, &(0x7f0000000314), 0x2)
write(r3, &(0x7f0000000600)="00020000000000010000000000000001010101", 0x13)
read(r2, &(0x7f000000031c), 0x13)
sendto(r0, &(0x7f0000000300), 0x2f, 0x0, &(0x7f0000000700)=@in={0x2, 0x1234, @loopback}, 0x10)
recvfrom$rxrpc(r1, &(0x7f0000000900), 0x100, 0x0, 0x0, 0x0) (async)
nanosleep(&(0x7f0000000800)={0x0, 0x1dcd6500}, 0x0)
executing program 2:
r0 = socket(0x8, 0x2, 0x0)
openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl(r0, 0x40046102, &(0x7f0000000100)="0100")
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)
executing program 1:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000100)={'syzkaller0\x00', 0x1})
r1 = socket$inet_sctp(0x2, 0x1, 0x84)
ioctl$sock_inet_SIOCSIFFLAGS(r1, 0x8914, &(0x7f0000000400)={'syzkaller0\x00', 0x1})
bind(r1, &(0x7f0000000200)=@in={0x2, 0x4e23, @dev={0xc0, 0xa8, 0x1, 0x1}}, 0x10)
listen(r1, 0x5)
write(r0, &(0x7f0000000300)="00000800450000540000400040840000c0a80102c0a8010110e24e230000000000000000010000380102030400010000000a000a00000000800200240102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f20", 0x58)

program did not crash
replaying the whole log did not cause a kernel crash
single: executing 1 programs separately with timeout 1m40s
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)

program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
single: successfully extracted reproducer
found reproducer with 3 syscalls
minimizing guilty program
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)
sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, 0x0, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x13c, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x4c, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0x0, 0x60}}]}, 0x13c}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)
sendmsg$nl_xfrm(r0, 0x0, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x94}}, 0x0)

program did not crash
testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB], 0x94}}, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
simplifying C reproducer
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)

program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)

program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
validation run: crashed=true
testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_xfrm-sendmsg$nl_xfrm-sendmsg$nl_xfrm
detailed listing:
executing program 0:
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000000)=@newsa={0x150, 0x10, 0x1, 0x0, 0x0, {{@in=@loopback, @in=@loopback, 0x0, 0x0, 0x0, 0x0, 0x2, 0x20, 0x20}, {@in=@loopback, 0xbe3412, 0x32}, @in=@loopback, {}, {}, {}, 0x0, 0x1, 0x2}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x150}}, 0x0)
sendmsg$nl_xfrm(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=ANY=[@ANYBLOB="940000002900010000000000000000007f00000100000000000000000000000000be3412020032007f0000020000000000000000000000007f00000100000000000000000000000000000000000000007f0000010000000000000000000000007f000001000000000000000000000000000000000000000002002020000000000000000000000000010000000000000002000000"], 0x94}}, 0x0)

program crashed: WARNING: suspicious RCU usage in xfrm_nlmsg_multicast
validation run: crashed=true
reproducing took 48m40.266176895s
repro crashed as (corrupted=false):
=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/xfrm/xfrm_user.c:1630 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz.0.17/5947:
 #0: ffff888029cda048 (&net->xfrm.xfrm_cfg_mutex){+.+.}-{4:4}, at: xfrm_netlink_rcv+0x6a/0x90 net/xfrm/xfrm_user.c:3928

stack backtrace:
CPU: 1 UID: 0 PID: 5947 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 lockdep_rcu_suspicious+0x13f/0x1d0 kernel/locking/lockdep.c:6876
 xfrm_nlmsg_multicast+0x1d8/0x1f0 net/xfrm/xfrm_user.c:1630
 xfrm_send_migrate_state+0x870/0xae0 net/xfrm/xfrm_user.c:3340
 xfrm_do_migrate_state+0x1749/0x1e90 net/xfrm/xfrm_user.c:3507
 xfrm_user_rcv_msg+0x7a8/0xf30 net/xfrm/xfrm_user.c:3907
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3929
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775
 __sock_sendmsg net/socket.c:790 [inline]
 ____sys_sendmsg+0x565/0x870 net/socket.c:2684
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2738
 __sys_sendmsg net/socket.c:2770 [inline]
 __do_sys_sendmsg net/socket.c:2775 [inline]
 __se_sys_sendmsg net/socket.c:2773 [inline]
 __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2773
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb235fede99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc10a8b768 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fb236275fa0 RCX: 00007fb235fede99
RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000003
RBP: 00007fb236083eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb236275fac R14: 00007fb236275fa0 R15: 00007fb236275fa0
 </TASK>

final repro crashed as (corrupted=false):
=============================
WARNING: suspicious RCU usage
syzkaller #0 Not tainted
-----------------------------
net/xfrm/xfrm_user.c:1630 suspicious rcu_dereference_check() usage!

other info that might help us debug this:


rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz.0.17/5947:
 #0: ffff888029cda048 (&net->xfrm.xfrm_cfg_mutex){+.+.}-{4:4}, at: xfrm_netlink_rcv+0x6a/0x90 net/xfrm/xfrm_user.c:3928

stack backtrace:
CPU: 1 UID: 0 PID: 5947 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT_{RT,(full)} 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 lockdep_rcu_suspicious+0x13f/0x1d0 kernel/locking/lockdep.c:6876
 xfrm_nlmsg_multicast+0x1d8/0x1f0 net/xfrm/xfrm_user.c:1630
 xfrm_send_migrate_state+0x870/0xae0 net/xfrm/xfrm_user.c:3340
 xfrm_do_migrate_state+0x1749/0x1e90 net/xfrm/xfrm_user.c:3507
 xfrm_user_rcv_msg+0x7a8/0xf30 net/xfrm/xfrm_user.c:3907
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 xfrm_netlink_rcv+0x79/0x90 net/xfrm/xfrm_user.c:3929
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775
 __sock_sendmsg net/socket.c:790 [inline]
 ____sys_sendmsg+0x565/0x870 net/socket.c:2684
 ___sys_sendmsg+0x2a5/0x360 net/socket.c:2738
 __sys_sendmsg net/socket.c:2770 [inline]
 __do_sys_sendmsg net/socket.c:2775 [inline]
 __se_sys_sendmsg net/socket.c:2773 [inline]
 __x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2773
 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
 do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb235fede99
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc10a8b768 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fb236275fa0 RCX: 00007fb235fede99
RDX: 0000000000000000 RSI: 0000200000000500 RDI: 0000000000000003
RBP: 00007fb236083eaf R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007fb236275fac R14: 00007fb236275fa0 R15: 00007fb236275fa0
 </TASK>