Extracting prog: 22.78263435s
Minimizing prog: 24m32.18721176s
Simplifying prog options: 0s
Extracting C: 21.86180208s
Simplifying C: 3m52.972849348s


extracting reproducer from 44 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socketpair$unix-socket$key-sendmsg$key-ioctl$SIOCSIFHWADDR-ioctl$TUNSETCARRIER-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$nl_netfilter-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140))
r6 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r6, &(0x7f0000000600)={0x3, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x2, 0x3, 0x0, 0x9, 0xe, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_address={0x5, 0x6, 0x6c, 0x20, 0x0, @in6={0xa, 0x4e24, 0x8, @mcast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x10, 0x0, 0x7, 0xc, 0xc0000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x9, @empty, 0x6}}]}, 0x70}, 0x1, 0x7}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f0000000100)=0x1)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
single: successfully extracted reproducer
found reproducer with 25 syscalls
minimizing guilty program
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socketpair$unix-socket$key-sendmsg$key-ioctl$SIOCSIFHWADDR-ioctl$TUNSETCARRIER-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-socket$nl_netfilter
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140))
r6 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r6, &(0x7f0000000600)={0x3, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x2, 0x3, 0x0, 0x9, 0xe, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_address={0x5, 0x6, 0x6c, 0x20, 0x0, @in6={0xa, 0x4e24, 0x8, @mcast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x10, 0x0, 0x7, 0xc, 0xc0000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x9, @empty, 0x6}}]}, 0x70}, 0x1, 0x7}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f0000000100)=0x1)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
socket$nl_netfilter(0x10, 0x3, 0xc)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socketpair$unix-socket$key-sendmsg$key-ioctl$SIOCSIFHWADDR-ioctl$TUNSETCARRIER-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140))
r6 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r6, &(0x7f0000000600)={0x3, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x2, 0x3, 0x0, 0x9, 0xe, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_address={0x5, 0x6, 0x6c, 0x20, 0x0, @in6={0xa, 0x4e24, 0x8, @mcast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x10, 0x0, 0x7, 0xc, 0xc0000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x9, @empty, 0x6}}]}, 0x70}, 0x1, 0x7}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f0000000100)=0x1)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socketpair$unix-socket$key-sendmsg$key-ioctl$SIOCSIFHWADDR-ioctl$TUNSETCARRIER-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140))
r6 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r6, &(0x7f0000000600)={0x3, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x2, 0x3, 0x0, 0x9, 0xe, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_address={0x5, 0x6, 0x6c, 0x20, 0x0, @in6={0xa, 0x4e24, 0x8, @mcast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x10, 0x0, 0x7, 0xc, 0xc0000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x9, @empty, 0x6}}]}, 0x70}, 0x1, 0x7}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
ioctl$TUNSETCARRIER(r1, 0x400454e2, &(0x7f0000000100)=0x1)
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socketpair$unix-socket$key-sendmsg$key-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140))
r6 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r6, &(0x7f0000000600)={0x3, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x2, 0x3, 0x0, 0x9, 0xe, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_address={0x5, 0x6, 0x6c, 0x20, 0x0, @in6={0xa, 0x4e24, 0x8, @mcast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x10, 0x0, 0x7, 0xc, 0xc0000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x9, @empty, 0x6}}]}, 0x70}, 0x1, 0x7}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socketpair$unix-socket$key-sendmsg$key-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140))
r6 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r6, &(0x7f0000000600)={0x3, 0x0, &(0x7f0000000640)={&(0x7f0000000680)={0x2, 0x3, 0x0, 0x9, 0xe, 0x0, 0x70bd2c, 0x25dfdbfb, [@sadb_address={0x5, 0x6, 0x6c, 0x20, 0x0, @in6={0xa, 0x4e24, 0x8, @mcast1}}, @sadb_sa={0x2, 0x1, 0x0, 0x10, 0x0, 0x7, 0xc, 0xc0000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e24, 0x9, @empty, 0x6}}]}, 0x70}, 0x1, 0x7}, 0x0)
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socketpair$unix-socket$key-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140))
socket$key(0xf, 0x3, 0x2)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-socketpair$unix-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140))
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r5, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r5=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r5, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$TUNSETIFF-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000180)={'syzkaller0\x00', 0x1})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-munlock-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
munlock(&(0x7f0000ff5000/0x2000)=nil, 0x2000)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-mremap-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-openat$tun-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-close-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
close(r2)
ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-write$cgroup_subtree-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fed007907001175f37538e486dd6317ce2200102f00fe80000000000000875a65059ff57b00000000000000000000000000ac1414aa35f022eb"], 0xcfa4)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-syz_emit_ethernet-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
syz_emit_ethernet(0x46, &(0x7f0000000200)=ANY=[@ANYBLOB="338687cfd8dfffffffff86dd68d82b060010000000000000000000000000000000000000ff02000000000000000000000129be000000000000250216fb1b821b9d41411b3ebff538fff6a26cb66e6a0000000000170401f8fbe6c9ba7513e4cb2f382e7668ef078d5b1c28b3bf512738a2fc1695445b9be898d858f33eeeb52bf8575f558591e46426a7d570f2abc56e63c55c170ce5d626e403cca1fb730362b1a12fdcdfa2cf0a4d8d43388568b81be5c4562a1092b22adadf38593b6c7ff68db1649f59ab18ee1c1954421cbced4ac8eeda84cfb050ed8f7284b53f69e1e86f772df71825b5614eb13f54f4e118864b64ddecd6d8ec31d1e46d09a339d5a3a07a33d636bf7e1b992a89c7720350027fb32a297e99c990"], 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-ioctl$TUNSETIFF-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
close(0xffffffffffffffff)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-openat$tun-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-getsockopt$bt_hci-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
getsockopt$bt_hci(r0, 0x0, 0x2, 0x0, &(0x7f00000005c0))
ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-setsockopt$inet_int-openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = socket(0xa, 0x1, 0x0)
setsockopt$inet_int(r0, 0x0, 0x2, &(0x7f00000004c0)=0x6, 0x4)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r4, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r1, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
socket(0xa, 0x1, 0x0)
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, 0x0)
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, 0x0, 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, 0x0, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={0x0}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, 0x0}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={0x0}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0)
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program did not crash
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, 0x0, 0x66)

program did not crash
extracting C reproducer
testing compiled C program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
simplifying C reproducer
testing compiled C program (duration=30s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing compiled C program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
validation run: crashed=true
testing program (duration=30s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-write$cgroup_subtree
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd634936f2})
r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000003c0), 0x1a3081, 0x0)
close(r1)
r2 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', <r3=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x401, 0x2000, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xffff}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0)
sendmsg$nl_route_sched(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000540)=@newtfilter={0x64, 0x2c, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x1, 0x9}, {0xffff, 0xffff}, {0x300, 0x1}}, [@filter_kind_options=@f_basic={{0xa}, {0x34, 0x2, [@TCA_BASIC_EMATCHES={0x30, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x24, 0x2, 0x0, 0x1, [@TCF_EM_META={0x20, 0x1, 0x0, 0x0, {{}, [@TCA_EM_META_HDR={0xc, 0x1, {{0x1002, 0xfc}, {0x1004}}}, @TCA_EM_META_RVALUE={0x8, 0x3, [@TCF_META_TYPE_INT=0x4]}]}}]}]}]}}]}, 0x64}}, 0x0)
ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000500)={'syzkaller0\x00', @multicast})
write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0x66)

program crashed: UBSAN: shift-out-of-bounds in meta_int_apply_extras
validation run: crashed=true
reproducing took 31m45.750158057s
repro crashed as (corrupted=false):
device syzkaller0 entered promiscuous mode
================================================================================
UBSAN: shift-out-of-bounds in net/sched/em_meta.c:763:14
shift exponent 252 is too large for 64-bit type 'unsigned long'
CPU: 0 PID: 371 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 dump_stack+0x15/0x20 lib/dump_stack.c:113
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds+0x364/0x3f0 lib/ubsan.c:321
 meta_int_apply_extras+0x13d/0x150 net/sched/em_meta.c:763
 meta_get+0x1f3/0x3f0 net/sched/em_meta.c:838
 em_meta_match+0xec/0x2f0 net/sched/em_meta.c:850
 tcf_em_match net/sched/ematch.c:494 [inline]
 __tcf_em_tree_match+0x1cb/0x7a0 net/sched/ematch.c:520
 tcf_em_tree_match include/net/pkt_cls.h:463 [inline]
 basic_classify+0xd9/0x240 net/sched/cls_basic.c:48
 __tcf_classify net/sched/cls_api.c:1550 [inline]
 tcf_classify+0x154/0x410 net/sched/cls_api.c:1590
 sch_handle_ingress net/core/dev.c:5207 [inline]
 __netif_receive_skb_core+0x186b/0x2fb0 net/core/dev.c:5420
 __netif_receive_skb_list_core+0x24d/0x770 net/core/dev.c:5635
 __netif_receive_skb_list net/core/dev.c:5702 [inline]
 netif_receive_skb_list_internal+0x7f8/0xaa0 net/core/dev.c:5793
 gro_normal_list net/core/dev.c:5947 [inline]
 napi_complete_done+0x375/0x7a0 net/core/dev.c:6685
 napi_complete include/linux/netdevice.h:505 [inline]
 tun_get_user+0x265c/0x33e0 drivers/net/tun.c:1979
 tun_chr_write_iter+0x1ed/0x2f0 drivers/net/tun.c:2030
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_write+0x14a/0x260 fs/read_write.c:647
 __do_sys_write fs/read_write.c:659 [inline]
 __se_sys_write fs/read_write.c:656 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:656
 x64_sys_call+0x8ef/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7efdabc37559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc153e0758 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007efdabebefa0 RCX: 00007efdabc37559
RDX: 0000000000000066 RSI: 0000200000000000 RDI: 0000000000000003
RBP: 00007efdabcceab8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efdabebefac R14: 00007efdabebefa0 R15: 00007efdabebefa0
 </TASK>
================================================================================

final repro crashed as (corrupted=false):
device syzkaller0 entered promiscuous mode
================================================================================
UBSAN: shift-out-of-bounds in net/sched/em_meta.c:763:14
shift exponent 252 is too large for 64-bit type 'unsigned long'
CPU: 0 PID: 371 Comm: syz.2.17 Not tainted syzkaller #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Call Trace:
 <TASK>
 __dump_stack+0x21/0x30 lib/dump_stack.c:88
 dump_stack_lvl+0x110/0x170 lib/dump_stack.c:106
 dump_stack+0x15/0x20 lib/dump_stack.c:113
 ubsan_epilogue+0xe/0x40 lib/ubsan.c:151
 __ubsan_handle_shift_out_of_bounds+0x364/0x3f0 lib/ubsan.c:321
 meta_int_apply_extras+0x13d/0x150 net/sched/em_meta.c:763
 meta_get+0x1f3/0x3f0 net/sched/em_meta.c:838
 em_meta_match+0xec/0x2f0 net/sched/em_meta.c:850
 tcf_em_match net/sched/ematch.c:494 [inline]
 __tcf_em_tree_match+0x1cb/0x7a0 net/sched/ematch.c:520
 tcf_em_tree_match include/net/pkt_cls.h:463 [inline]
 basic_classify+0xd9/0x240 net/sched/cls_basic.c:48
 __tcf_classify net/sched/cls_api.c:1550 [inline]
 tcf_classify+0x154/0x410 net/sched/cls_api.c:1590
 sch_handle_ingress net/core/dev.c:5207 [inline]
 __netif_receive_skb_core+0x186b/0x2fb0 net/core/dev.c:5420
 __netif_receive_skb_list_core+0x24d/0x770 net/core/dev.c:5635
 __netif_receive_skb_list net/core/dev.c:5702 [inline]
 netif_receive_skb_list_internal+0x7f8/0xaa0 net/core/dev.c:5793
 gro_normal_list net/core/dev.c:5947 [inline]
 napi_complete_done+0x375/0x7a0 net/core/dev.c:6685
 napi_complete include/linux/netdevice.h:505 [inline]
 tun_get_user+0x265c/0x33e0 drivers/net/tun.c:1979
 tun_chr_write_iter+0x1ed/0x2f0 drivers/net/tun.c:2030
 call_write_iter include/linux/fs.h:2218 [inline]
 new_sync_write fs/read_write.c:507 [inline]
 vfs_write+0x831/0xfd0 fs/read_write.c:594
 ksys_write+0x14a/0x260 fs/read_write.c:647
 __do_sys_write fs/read_write.c:659 [inline]
 __se_sys_write fs/read_write.c:656 [inline]
 __x64_sys_write+0x7b/0x90 fs/read_write.c:656
 x64_sys_call+0x8ef/0x9a0 arch/x86/include/generated/asm/syscalls_64.h:2
 do_syscall_x64 arch/x86/entry/common.c:50 [inline]
 do_syscall_64+0x4c/0xa0 arch/x86/entry/common.c:80
 entry_SYSCALL_64_after_hwframe+0x66/0xd0
RIP: 0033:0x7efdabc37559
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffc153e0758 EFLAGS: 00000246 ORIG_RAX: 0000000000000001
RAX: ffffffffffffffda RBX: 00007efdabebefa0 RCX: 00007efdabc37559
RDX: 0000000000000066 RSI: 0000200000000000 RDI: 0000000000000003
RBP: 00007efdabcceab8 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007efdabebefac R14: 00007efdabebefa0 R15: 00007efdabebefa0
 </TASK>
================================================================================