Extracting prog: 29m6.042494993s
Minimizing prog: 2h0m21.144014229s
Simplifying prog options: 14m41.462709911s
Extracting C: 6m21.545990931s
Simplifying C: 0s


extracting reproducer from 51 programs
testing a last program of every proc
single: executing 11 programs separately with timeout 6m0s
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket-ioctl$sock_SIOCETHTOOL-bpf$PROG_LOAD-bpf$BPF_GET_PROG_INFO-sendmsg$nl_route-openat$cgroup_ro-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_TSINFO_GET-ioctl$sock_SIOCGIFINDEX-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-sendmsg$ETHTOOL_MSG_EEE_GET-openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-socket$nl_generic-syz_genetlink_get_family_id$tipc2-sendmsg$TIPC_NL_LINK_SET-ioctl$SIOCSIFHWADDR-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-socket$packet-ioctl$sock_SIOCGIFINDEX-sendto$packet
detailed listing:
executing program 0:
r0 = socket(0x2b, 0x3, 0x1)
r1 = socket(0x400000000010, 0x3, 0x0)
ioctl$sock_SIOCETHTOOL(r1, 0x89f0, &(0x7f00000001c0)={'bridge0\x00', &(0x7f0000000400)=@ethtool_ringparam={0x5, 0x0, 0x5, 0x2, 0x0, 0x0, 0x10000, 0xffffffff}})
r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x3, &(0x7f0000000640)=ANY=[@ANYBLOB="180000000000000000000000000a000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000280)={r2, 0x124, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, <r3=>0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x8, &(0x7f0000001e40)}}, 0x10)
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000a40)=ANY=[@ANYBLOB="2c00000001084175ebafbbc2045e11fd00000000000000000000000000c97fd96536eb89160ac63a29c5dd54b4248c7f4f4e0f4391802cffd70d3560cab191b6fe8ee06747a49428d121f55100a5ab45227ea9670b28ccdd476f4dddfe0b7a76a631495a93c4ecb6e9aef7842e57d8085e0677e7706c033e4253d55fc60dea003fb30796d49ee13fc8109a8244d1024c4ee7b17a6eff0bbc", @ANYRES32=0x0, @ANYBLOB="2e2002000000000004002b8008001b0000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x20048050}, 0x20040090)
r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r5)
sendmsg$ETHTOOL_MSG_TSINFO_GET(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=ANY=[@ANYBLOB=',\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002dbd7000fedbdf252c00000018000180140002"], 0x2c}, 0x1, 0x0, 0x0, 0x20048881}, 0x20008880)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000006c0)={'dummy0\x00', <r7=>0x0})
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000700)={'batadv0\x00', <r8=>0x0})
sendmsg$ETHTOOL_MSG_EEE_GET(r4, &(0x7f0000000940)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000900)={&(0x7f0000000b00)=ANY=[@ANYBLOB="b0010000", @ANYRES16=r6, @ANYBLOB="04002abd7000fddbdf25170000002c00018008000100", @ANYRES32=r3, @ANYBLOB="08000300030000000800030003000000080003000000000008000100", @ANYRES32=r3, @ANYBLOB="4c0001800800030001000000140002006361696630000000000000001400020076657468305f746f5f62617461647600080003000200000008000100"/72, @ANYRES32=r3, @ANYBLOB="5c0001801400020067656e6576653100000000000000000008000100", @ANYRES32=r7, @ANYBLOB="08000300030000000800030000000000140002006e69637666300000000000000000000008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r3, @ANYBLOB="08000300020000001400018008000300b5eeabce08000100", @ANYRES32=r3, @ANYBLOB="340001801400020063616966300000000000000000000000140002006272696467653000000000000000000008000300000000003c000180080003000200000008000100", @ANYRES32=r8, @ANYBLOB="140002006261746164765f736c6176655f3000001400020064766d727030000000000000000000001400018008000100", @ANYRES32=r3, @ANYBLOB="08000100", @ANYRES32=r8, @ANYBLOB="300001800800030002000000080003000000000008000300030000001400020076657468315f766c616e000000000000"], 0x1b0}, 0x1, 0x0, 0x0, 0x20000800}, 0x40800)
r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r10)
r11 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r12=>0x0})
sendmsg$nl_route_sched(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r12, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
r13 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff)
sendmsg$TIPC_NL_LINK_SET(r13, 0x0, 0x8000)
ioctl$SIOCSIFHWADDR(r10, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r14 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r14, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r15=>0x0})
sendmsg$nl_route_sched(r14, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70b906, 0x25dfdc01, {0x0, 0x0, 0x0, r15, {0x0, 0x7}, {0x1, 0xb}, {0xffff, 0x8}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x240040f4}, 0x4890)
r16 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r16, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', <r17=>0x0})
sendto$packet(r16, &(0x7f0000000280)="05", 0x1, 0x4088, &(0x7f0000000140)={0x11, 0x86dd, r17, 0x1, 0x3, 0x6, @remote}, 0x14)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route_sched-socket$nl_route-socket-bind$netlink-socket$nl_route-socket$inet6_udp-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-getsockname$packet-sendmsg$nl_route-socket$kcm-socket$inet-ioctl$sock_SIOCGIFINDEX-socket$nl_route-getsockname$packet-sendmsg$nl_route-sendmsg$kcm
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x803, 0x0)
bind$netlink(r1, &(0x7f0000000100)={0x10, 0x0, 0x25dfdbfd, 0x400}, 0xc)
r2 = socket$nl_route(0x10, 0x3, 0x0)
r3 = socket$inet6_udp(0xa, 0x2, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00', <r4=>0x0})
sendmsg$nl_route_sched(r2, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=@getqdisc={0x48, 0x26, 0x200, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, r4, {0xf, 0xc}, {0x4, 0xfff2}, {0xb, 0x7}}, [{0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}, {0x4}]}, 0x48}}, 0x0)
getsockname$packet(r1, &(0x7f0000000380)={0x11, 0x0, <r5=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000080)=0x14)
sendmsg$nl_route(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@newlink={0x3c, 0x10, 0x40d, 0x70bd2a, 0x0, {0x0, 0x0, 0x0, r5, 0x40109, 0xc000}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bond={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BOND_MODE={0x5, 0x1, 0x5}]}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x404c084}, 0x0)
r6 = socket$kcm(0x10, 0x2, 0x0)
r7 = socket$inet(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000300)={'bond0\x00', <r8=>0x0})
r9 = socket$nl_route(0x10, 0x3, 0x0)
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, <r10=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0xe)
sendmsg$nl_route(r9, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000e00)=ANY=[@ANYBLOB="44000000100001042abd70000000000000000000", @ANYRES32=r8, @ANYBLOB="0028000000000000140012800c0001006d6163766c616e00", @ANYRES32=r8, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r10], 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0)
sendmsg$kcm(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000040)="d8000000100081044e81f782db44b904021d006a0f000000e8fe55a1290015000600142603600e120900040044000000a80016000a0003402e60000000000000b94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a985162f7ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d3220a7c9f8775730d16a4683f1aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x60044084)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-ioctl$XFS_IOC_FD_TO_HANDLE-socket$pptp-close-socket$nl_netfilter-close-socket$nl_netfilter-openat$tun-ioctl$TUNSETIFF-openat$tun-socket$nl_route-socket$unix-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-sendmsg$NFT_BATCH-close
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
ioctl$XFS_IOC_FD_TO_HANDLE(r0, 0xc038586a, &(0x7f0000000340)={r0, &(0x7f0000000000)='*:!\x00', 0x1c1000, &(0x7f0000000040)={@_ha_fsid={[0x5, 0x3]}, {0x401, 0xf02c, 0x8, 0x100}}, 0x400, &(0x7f00000001c0)={@_ha_fsid}, &(0x7f0000000200)=0xfffffc00})
r1 = socket$pptp(0x18, 0x1, 0x2)
close(r1) (async)
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
close(r2)
r3 = socket$nl_netfilter(0x10, 0x3, 0xc) (async)
r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async)
openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) (async)
r5 = socket$nl_route(0x10, 0x3, 0x0) (async)
r6 = socket$unix(0x1, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r7=>0x0})
sendmsg$nl_route_sched(r5, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r7, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x1}}, [@qdisc_kind_options=@q_mq={0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084)
sendmsg$nl_route_sched(r5, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000700)=@newqdisc={0x24, 0x28, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffdf8, {0x0, 0x0, 0x0, r7, {0x10}, {}, {0xd, 0xd}}}, 0x24}, 0x1, 0x0, 0x0, 0x40098}, 0x40000) (async)
sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) (async)
sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000580)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a50000000090a010400000000000000000ae8ff030900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc0c0009800800014000000002080008400000000114000000110001000000000000"], 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async)
sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000010000100000000000000000005000051f531177bd2dced0100000000000000000a0000060900020073797a31000000000900010073797a310000104014000380100000800c00018006000100000000001400af001100010000000000000000000100000a5de60c73248e56a69417fa3965c11d96e800d8f45bd1a7f5ec8861fecb6fce0dbf6b1e5c27bbd0a3dd60608990e286afcd8f700cc1975e6f6f0be63bbc649eec02340b44407c6594868586"], 0x68}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) (async)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a400000000c0a01010000000000f9ff000a0000090900020073797a31000000200900010073797a310000000014000380100000800c0001800600010058"], 0x68}, 0x1, 0x0, 0x0, 0x4004850}, 0x40)
close(0x3)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$tun-bpf$MAP_CREATE-bpf$MAP_GET_NEXT_KEY-bpf$MAP_LOOKUP_BATCH-ioctl$TUNSETIFF-openat$tun-close-socket$nl_route-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-socket-sendto-syz_genetlink_get_family_id$nl80211-sendmsg$kcm-socket$packet-sendto$packet
detailed listing:
executing program 0:
r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0xa, 0x200, 0x7, 0x1}, 0x50)
bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000140)={r1, &(0x7f0000000a40)='&', &(0x7f0000000040)=""/98}, 0x20)
bpf$MAP_LOOKUP_BATCH(0x18, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000400), &(0x7f0000000480), 0x2, r1}, 0x38)
ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101})
r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0)
close(r2)
r3 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', <r4=>0x0})
sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r4, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x3}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0)
sendmsg$nl_route_sched(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0x25dfdc01, {0x0, 0x0, 0x0, r4, {0x0, 0x10}, {0x1, 0xb}, {0xffff, 0x5}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0xffff, 0x1}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x240448a4}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast})
r5 = socket(0x10, 0x803, 0x6)
sendto(r5, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r5)
sendmsg$kcm(r5, &(0x7f0000001c40)={&(0x7f0000000140)=@in={0x2, 0x4e24, @multicast2}, 0x80, &(0x7f00000017c0)=[{&(0x7f0000000440)="d2f5fd61e82cf79d7d7ffd8b431ca3c810016962e22b845c8d175eca947815ab5db763f59e60b6bda27dc9542e19e8034223a8c2d3ad34c8296f0684be13f6af3869a595b52b411844690b8956827f5db7a2c16a368496f227960c3190d20364466f2d0f978176fdd6f9d5c82fd69564d84cc78091edfd2822f66d608d464b4c306f3404ba1e7be28d7a3f16ddd73549d6e9a37d41f007d5cd10fd07a0b9b4fc9b4f83a51ce0957eda73b6751e2c24581cf45930ef07d6bcc9b0f04bffc5ff89df4bb3568e40fedd8cefaa8b3d92d0662c45b3dfa9d0ec9584bc700aa9ddabe4d609d831b1c0976c73", 0xe9}, {&(0x7f0000000640)="4d7cd55f2ca5d87087a733aecebad283736ee75625b0f5032b78d588907792c131c879bee61cc75f0745d68f0855778159508a765115122e18dca6424daf1ec59c1e2ce788a11ae8c72f848c1c49c11ff76e41116120bb3588544b01686579463d67dc9408dd4d8bb3e4ba57d3cfbb86de2a4909f9f2be51320d4fed1e2efcccba9248b43a2819262b31589b015f418fe3dba73bd806a5b6132911eafaf0ae443399b0d0a3050c7978ace6189c951e6c0574ea5b905aed82b48a87da1b71a3ef26bebebee714390532b310ac58b5c99388fa558a5d5501dc67950eb44d3cf1a473d331e2ec844a0b6e9c61ea7ad2e0015757801a090a815181c19a7439b5918dcd8df59c2333577be6ff130943141571dee4d8bbb44391602d3efee05f67f5d0cd0e7649e54125347a83f9b89cd69f960c53a34f593b52f8de58fc5f318dc9bccddb6e7595a22eb2e82442b9d11e1ffc5b310bde19cbcc4cebb09c176a9105e8414eb8c8fdb9c02d9e48702f1f11d918feaf50af89053f35b8ab8138d7d05affa381f25a0b6255a07cb669dc047df99044cf3da56b9e1db887e1effa19cab36fa9cbdfe95e80c9786348f13a5900756d582949e939489ac2a5bac42b82a71e74ef85d2a1fe51c524074b7dae7027a334c12a23042e1524d186a9b0e6a52d7ef86a1e5f2dd624d593c965bd31abba9d7febbf20625121890529ea7fef65bae8bdd98da15703ac87c2418997678537bd3246818990eca6d8735b7b7eed7df98a349e023df5b00e74816704fac89150b3f596cc9856959998b474796185a84761dd29ddb9cf940c1bfcc8cbed811ba297739a79bf457f6dd4df738090b55b9fbe6c7830903884f13b53f31e5e6ad13d14795729a5dd79f3bceba674d001a7b2d20ae1776d37cb5165467b8e3b898e4e52b34f2df8436f1e916d7d23f8b78c224395ae70b6c5478686e5e70b6e0c44daeaabdeeadc40091ab551cdaf4a599fd247b3d434bd51c786d44ea75f1297fa3d2efd9e398fcb94bda3f73257389bdd6df35dc60ade5e2d473b4f03df44b146e7bc61d3115938347cdbe9bcdb50b8225affd0199c8fc4675e9b02b210021b848326ee32c3e931b1f12f3b4cc963b2d92926e4f1053f71a525ac0a266c27d6a3468d122ff38d9a4ab1eadc1675b9480582f526c8c7ae84dbe0a40750d664dc578848b935aaf7c3da165e9cbe63402737ad2f65019015e278d6e8badf8689d3ca71119c5151ec457c15526992f2ffbdd2c60de187cd738a1f9e28376f9f2c6dd74749df5d84c7c7721e49449f78ee6c17570b1f8fbea38de69dd17a91bfdcc9d5ab1e9ec6ba4fd09013d272958322d99e49c32cfa96b2daf9c948549a3dde696b79eb456225e4475706bc8df92898e968553cd17f91939b2ee95d20ad9b343c19d6fe372d04af4afc4b00c331f3da5d7cfa57652db3fab8b8fdf53f31ae15a9b897c757fa6285c80c012140bd763b85c3a3f815740565e78276163787c977d4d97c5de80f14096e87c9f732b3d752cd04213ff7318f2164bf2045b442d4a66403a201e0e5e92a00a665e5cef1cfc5ca9640462146d601fb7061d89f2555cbc55ef5e076e68b210289514a44365e7407cd54a6af9f8e469c53f097b96d8dbb900d86bba3ae20240823b7529db0d125d4b4382472bd17545bd38d1b120f8cfa090fafcba5994e0322fbbb7d44fa21753869941897cf56f2d3c2cc67c691f3eef416b2c21a569f732cceb6b5eec86a3e861c3e84cdbdd05caf99bd4d371c34b22637ba098cff77d502b9bf57da43a652c05e5c6bada8e4caf6d08330e8ce9fff1e3866a5355009f304d36e4fc2ee7b07b57c004b9c8cb8b34d4fe150c8a0cf0e36c2f2a1974e03d0f9a4266e488ebf655541cdda24f2ed7337b6c319fa12f88898b4c08213098bc755e19a09018f928cc8be02731a7d75ad915f416798def4eb4a4dbd2f79e52f07b3ec9f9d25688807a5ee84dad17b26fcc627355c70b05e35174d5b67d5a32d28914e3ecdae2f26d5c11303ac846b5da5ffe8c8bea37314ad7d5dfcf2591db5da2e723229d9764fb431b73e14cc35af317cf9e3755dca84f43faa7b3169e8bb9b6ee91436f9b890b1c0bb24944ae8c92a92cbf6ed258ef5d816cd651de2518497cfcee201ecb00aa1c97e43da994aa305bba08b3ae89a2070286b7dfa3167f8b45b0aa3f5c56cf1789d68fc93a0cb03e4edce1bc2e900cce5722f6745adc170000b530b6f49f038b8768cffc42028e29effe302461ce3c2fb7e2b3f050728a2386f82b6864aedec5605930b26afc603447f53d6d93bafa53b4560865a6e7d033dba938081240e1a79aeee46d3a37e4a17892a02d724eee05ce1214b6de9e6859483901e681048032b39398d539965c492e7b193f20f83d68bd96414e4926d955d4b64ce96af7239de44bda41e39301fb04a904ad14f2e4215122797b4fa5756b1bace4328acbc3f8bc194502ad0f72f57ef5f80cea4877420bf4677c8436a0cd24e491e939df6b4c98c4ff2d7dbf9a6e06b5ce9f51179aa14b17849e873e74ec600771ecf340a0f59dabc8314c98859cb7728716986b95ae68f502b17e9403f2fb2a3830a8b543f5301b1b334027d1e2099c9a0438b7ea35ef030968bc398fde558bf3bdd8ac236835ada97ecadebf29909f3b29f55eaed0b8f6c384177b9b90717eea298c7b7b75bb845ab22e72631508c9ce34821f41c513ca18fdd21a64f44bcb0984a66e354359eaefc6f60d759bc4b47a9197a08d19ce0fabba05c242c1a7382bb9582a20f9f4adcd72f61071b27bc8ccc6675a35d832c01ec1d046937d29dea2d703ad736e7039701692f21531dd9f02ab4d90af157d91cfc26cdfe20c0a52d2d2ffdcb5d3533c2f3fb33a0100cbb1608c107b2a4312789414cf590d4d5529d86c26c612ddccbef8d151e2319cabfe4ed7c9ab8ff4e0455edecfd8524c8b48b5e6b22176a1ba1b3e575ffb36ad2faa991a898802c552067cf95868615edef7ccb8cf395206ddc330b2fd5669db985e3f92477ab335eeed8d5c954a5a04da3ace9770b47628b748bffd80d7a9da7d532b18b99949d2a8a1f8b59e458263ca3980b2d3959ac93de3b65af0503454e28bef7b52e29dfd261ddb30498020fc93e02cdf407675fd62fec216b666068ab6d495bf74528de5500d03746ac6445d5ba3d0ef175901d0c7173d58f9b4e80c1fda0c2525f1a3417094f04ea4fb4b6d7adf8583afcdc352b90666f958b9290077239203db2d457369948a68669c9fe5b7089adb7344091e8efcba77a7c14411f659d6ed6f1ae763f0363a4886c75d4d398020c9938d943c1e3547fbee42cdc1427355903f297382961187b28e00c85b91c193d2f9f4d4ab8a4123faa8f2c67804ad872dc059ea9d1e6251c7f17232d9d30a4b32d2e86050d1b72ed9f52ad71177515166f30662df2db9fa2e9194ca9504b593d3cdfd8e79fdb3e548ed70379bf0543db96abdcb89dc474c7294703e99e0e639b817764ac3aadf8ca61f08a9b18bcf0a122def473ee42682d98251f68809a0fe223affc83969babf31e6cddb5d2719d852fe592e159ae0050f736eb933c7196eb2836b350d2c505bf65c1a971011f5611d343cd7916264b06ccb9b7ac038a2dcea2dfc273a1127178088e84f0bbe83cf0225b91c4beeadbe9ace3b3e6de09930da8ad279579d704cdd4a9c092adc4c3b7e6a32a301ddedf7b4dbc04ec8241546457cf4fcc6cec5513afc9f01940d024da45e1437e7141e55f343a6302b91dd19bde3e327a75c0733a3aa230eeec821d204de62ed50962085fea24767526a3d48038869b81cea5c114a29c831fa4fadc02d6bd0b2e0806aad3da14ecf1683cd0d0cf2ccb4995d0cfa49c8fe4bc6e820787132daac39a1382c11e0690d83ec4a568ac6a417fe77a42403a12c2c73eb34b9a7bb74c270eb52605d876931a586a7dcbbf899125bf9513b056fb7c39bbfb684b19511686b1b079095767d172af03ec4b183ba2a3a80247b76c2c2263194de62513cabd17737149b7256cd35aaaf8f62d66b2789e3631bf6b85fa6374e47ecbe56cc3e23e9ec9dcef1c895f983fa61cfeb3c3d955c0834e7507e04d0c5ebb6291172c268666b492db7d78c74c89ca7ddc0e86732c6d3de960db487c8267578ca78c8cb4727dd965fba7af770487ef8eb659272aefb95ee1c64316018b9d5cfdd873d0bfc5e3e621eaf5af213d3bbd370ba22307c3d21b455562077c6d3b41aeadd56dd59d2fbbec4ebbc0bd82ed133535b69a32b8de0d002214cc78a84e53db15991397335b861d2b5987bc131297f08879539feb034c0ab4dddbf053209c4513769c412eea345c3cf75ae41a481e96eac37efd5033aa7adaf9e203e92f9fa40f290dae91e6102fe0dc8c94a2fd282f09d40f4e53b31f6568240222a5cc487e2613f894d24c3782b7a2708da0e67a6af41b2013b404a48841b1c5fa61b796b7f041803cef7c0c891a2ebf8c51968c890570d99fc799d82d9a6a02698234c6baa037a04a3117492695438f2e5a8cfa643455b4222e4982a63aa5674225c84aa6755a835847cd98d92f83470383cdf1c155a7c39d2bb138fad0b3e6c8610d5f987dede5a17904b87a798fc609358a0ddc8ceb08e74b5ea3f527f1ebaea9040b33831ce46f3b1ae66cea468a429e4b22d4139c349466d91c9bbfc7dda6610def9ac6458481a7f1ae20e5c9c9cd588ff16c153f42e6d7ffb9d8f8ccdc17529d4fa5aa176e429863b66c99e18aba42aed50851796a8c960b28516af29f53d25549c2aac120375c09da253ddfb81d7a1049133dafa41e546760e7d9b21eaa489b4ec5834531a6c4647eaddfa98238a965a3e1d02ce423e4f2c3c4f5475123a69e7cb19dd02ef11339e39052073d5d137b2bf42153b03f8163d7b5ab8fa70412d958e0d1f837f3c0f72571c3c305ff82cbe548593833d919cb1c0de10fd153623f2f83d881cd4903df441478497a33522b8b3ca60360120fb6ed1856c10c48718c16b46919a07b6524c39e9dd768ef369993c18dab46d32999fcadb0014716dffa49fb48e45bfa774cfa06916fe81be11e45fa3ce94d4854c2360383ec4536089a3d9f428215df1692ec0894b9895f0466d2855b444a2620a563d880655933089689eaa164109ee81c2853abf1afb3656a45d13cfe600c3aa9138e0219cf0b3d16565d8ad9f1d30888c39cdf339639f267323888024282d96fde58a7c2ac6b674909b30bddda7509f421a4a182dbf321cece8585ac1e82a4339e4bb55429e3295cf951071ae7838cb8e58e581b1d47ea8d434cfbf10bebf76480672389be66b61982d58ada7423552654363ca09c22eaefc934f4b22194e3dc0ddf7e7ab2fd6819e62b73464e922a58dd835ce6f066d46cf14b0a1d3bcfc4e7cbfd4404198db8803f081c10038ea1c2732b31f705cbe3d1bc9ea20b8186abb047cbba77384a2841b6c2e8228bc74d0d3db09349f67bc11676ca8b4a6a613db98813f9806833630f9a56a13fb3864007124e1e0ba8f87f2b6a9d87d6f9767704b8e81a899710c055040c16c18008fde8c9f958cce6279b2f836b9cccc0c8d3c261bc69bb4ae9d6410cdc50f744dae690db7839327cef1a3c525b2c756a718132458c9740d5ae496a917947a6e47b8b7e58dc2a6d72a4f472703700ac383cebeca0be4077c566e33853c7912d98d05076126010a5c167cb5afb53016ffd591519eb4a7d8dc342c166a0660422a334cec66c5fe7bcd8c678930d077f2486cff5010e891203ea", 0x1000}, {&(0x7f0000001640)="4cc3434110fbc7ea598ec149049c589dc999414fea1d59bdcf553b024b680b1255942070558566f0c5bf1535ab", 0x2d}, {&(0x7f0000001680)="7d5dc649359a7e3b2694719f926808d8cbe0e32bc5cf86015825eb616f9eccf7d12701e813dc203cb5c250662187f3c826b381e2d070c3720b495803a4792f065041f56409d5cb34eb4ce59e03efc1d9cec5edb2acd65abfcaf576f21a4e4fa9c768209a1d64804a685bde93658585a327f4c03d14528daa85f17d46f43b188f3bce77a7b21e249f0d5af6fa78b0bb4acffa10f18041c5ae897ff1d6b0b8cd1571dbc9d4af723f2fceba22bd1129b1d50d0631dc", 0xb4}, {&(0x7f0000001740)="37be8ccc5981e4118fec261323a548676d1221b411a0012272e5152167a71288db9066a4304ad490847948b44f2d086047527c187fb0bbb5db725473b6734043aef40cf5d8243557d447494641", 0x4d}], 0x5, &(0x7f0000001840)=[{0x28, 0x84, 0x340, "db5ff35bbe827a620667d4fa23d5fe1efb8ab651"}, {0x100, 0x108, 0x1, "380576b59e9368e6ba55320459af67c9be02697c210b3ec5c1904ecdbae6c93863802b57e208e47e96dc1ac40538a359105713ea8fe2d3c475de257e5ee90068a8d4205d6c92988766868be4b1f040aecbb9b48b574692a07a1456b4901d9b528ff8b0af06ee986626dd2114df3eb56cc7d0ba5303266bf23b3bbf87fadaf2c1d20dae96021aa708ed9fac2b6603313a7c9c4d663a93c355cda207cb4ea30833ccf79e30c7bf493d8e26b5947492a9e5c15aa392fe2899d1dd6a962d0de34b0a754c1f7d7e73a86221d9e77c15b02e74c3710f885a2ef8729ab91be69cf73b4c6cea75d3ffcdd3b600128daba6"}, {0xf8, 0x119, 0x4, "d0856465469420bd67170e1ac27510e0c0e62ea046c4e9a4413d2223d0736ee8a4e905bd3d17ae4387391487d06ce6cb53fa6c1ac48138438f81981ba992099d561d2844239cd0198785d5269aece707be25e57df1752f100251bcb1409a2155e8ee870e7eadd8a3c2919c2a78fe628feaa41e8d86bbe05e91b799cd7be4f23b7e0429cce3edae04a21f74a61413ce1ce2e5558a0f31c142125cf0722fe06a76859b532431cf8df8f17790efdb10bf84409bc1de205a8a7180db7e16c2d0d41a403707d671de448dbad7419b684188a88ba88e2263437ebf14de25be5fac4d2eca203303"}, {0xd0, 0xff, 0x5, "c5cc1c9d2c75881e4e701132dd4012ef87c8a014b01d8bc686c6be3c6dacf1678901cf38f6ca0d6972b644177b0ac78cf83f96e95522373d17f7b063677e677bde7c0d3b14125ff88ac83e4de9433c2a061b2d7fbe21612ae7a35df80e05508b17b8238f181dc0a617a68160ddebeb8431c3140d9dfd751d4808c77150d402080f3e208c672d14a161c5fa184b833c28517bf2eb486c8419c212e2f0b084c971d15a1feed21c900814fa335e36f6e69292c10bd4e8f8322aeae77c"}, {0xe8, 0x115, 0x1, "220f3cc3aa2b1b4621a360fe55f2766e3ef5dc00798b2e1db1693b411d591bb6b093b1548b91959f8fad7be3c767161c3d354092228dbbc17a54551b6acc5e699c835d32fc9e0eb3f0836d8868d3e7eccf7ebbea460e42fa9c8a4f7ead7d348843c77187e169503b9645c345f497fd46da1618debfd5c296efb22aaed22613ff0650ac00880639bd9677da169797f4d70c4eac64753d114cb717f22a19a9d8266f85c04012882d590fea21107b1e6a2339db27bd26c043d6eeccac6a5f635bd286a1b75b6b2b97e4bfbda6f114fb5ea316719bdb76"}], 0x3d8}, 0x8000)
r6 = socket$packet(0x11, 0x2, 0x300)
sendto$packet(r6, &(0x7f0000000280)='0', 0x1, 0x40000, &(0x7f0000000340)={0x11, 0x6, r4, 0x1, 0x2, 0x6, @local}, 0x14)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket-close-socket-socket$inet6_sctp-shutdown-close-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-sendmmsg$inet_sctp-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS-sendmsg$ETHTOOL_MSG_STRSET_GET
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)
r8 = socket(0x2, 0x80805, 0x0)
close(0x3)
r9 = socket(0x2, 0x80805, 0x0)
r10 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r10, 0x0)
close(0x3)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r10, 0x84, 0x6f, &(0x7f0000000200)={<r11=>0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r10, 0x84, 0x7a, &(0x7f0000000340)={r11, @in6={{0xa, 0x3, 0x3, @mcast1}}}, &(0x7f0000000040)=0x84)
sendmmsg$inet_sctp(r9, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r8, 0x84, 0x84, &(0x7f0000000440)={r11, @in={{0x2, 0x4e23, @empty}}, 0xfffc, 0x86}, &(0x7f0000000500)=0x90)
sendmsg$ETHTOOL_MSG_STRSET_GET(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)={0x1c, r7, 0x4, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x4}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x6051}, 0x4000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
single: successfully extracted reproducer
found reproducer with 25 syscalls
minimizing guilty program
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket-close-socket-socket$inet6_sctp-shutdown-close-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-sendmmsg$inet_sctp-getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)
r7 = socket(0x2, 0x80805, 0x0)
close(0x3)
r8 = socket(0x2, 0x80805, 0x0)
r9 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r9, 0x0)
close(0x3)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000200)={<r10=>0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r9, 0x84, 0x7a, &(0x7f0000000340)={r10, @in6={{0xa, 0x3, 0x3, @mcast1}}}, &(0x7f0000000040)=0x84)
sendmmsg$inet_sctp(r8, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0)
getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x84, &(0x7f0000000440)={r10, @in={{0x2, 0x4e23, @empty}}, 0xfffc, 0x86}, &(0x7f0000000500)=0x90)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket-close-socket-socket$inet6_sctp-shutdown-close-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR-sendmmsg$inet_sctp
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)
socket(0x2, 0x80805, 0x0)
close(0x3)
r7 = socket(0x2, 0x80805, 0x0)
r8 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r8, 0x0)
close(0x3)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000200)={<r9=>0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r8, 0x84, 0x7a, &(0x7f0000000340)={r9, @in6={{0xa, 0x3, 0x3, @mcast1}}}, &(0x7f0000000040)=0x84)
sendmmsg$inet_sctp(r7, &(0x7f00000032c0)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="30000000000000008400000001000000000000017c"], 0x30}], 0x1, 0x0)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket-close-socket-socket$inet6_sctp-shutdown-close-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3-getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)
socket(0x2, 0x80805, 0x0)
close(0x3)
socket(0x2, 0x80805, 0x0)
r7 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r7, 0x0)
close(0x3)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={<r8=>0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)
getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r7, 0x84, 0x7a, &(0x7f0000000340)={r8, @in6={{0xa, 0x3, 0x3, @mcast1}}}, &(0x7f0000000040)=0x84)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket-close-socket-socket$inet6_sctp-shutdown-close-getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)
socket(0x2, 0x80805, 0x0)
close(0x3)
socket(0x2, 0x80805, 0x0)
r7 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r7, 0x0)
close(0x3)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket-close-socket-socket$inet6_sctp-shutdown-close
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)
socket(0x2, 0x80805, 0x0)
close(0x3)
socket(0x2, 0x80805, 0x0)
r7 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r7, 0x0)
close(0x3)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket-close-socket-socket$inet6_sctp-shutdown
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)
socket(0x2, 0x80805, 0x0)
close(0x3)
socket(0x2, 0x80805, 0x0)
r7 = socket$inet6_sctp(0xa, 0x5, 0x84)
shutdown(r7, 0x0)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket-close-socket-socket$inet6_sctp
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)
socket(0x2, 0x80805, 0x0)
close(0x3)
socket(0x2, 0x80805, 0x0)
socket$inet6_sctp(0xa, 0x5, 0x84)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket-close-socket
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)
socket(0x2, 0x80805, 0x0)
close(0x3)
socket(0x2, 0x80805, 0x0)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket-close
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)
socket(0x2, 0x80805, 0x0)
close(0x3)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool-socket
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)
socket(0x2, 0x80805, 0x0)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic-syz_genetlink_get_family_id$ethtool
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r6)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK-socket$nl_generic
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)
socket$nl_generic(0x10, 0x3, 0x10)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r5 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r5, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
socket$nl_rdma(0x10, 0x3, 0x14)
r1 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r1, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r1, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r2)
sendmsg$GTP_CMD_DELPDP(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r3, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r4, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-syz_genetlink_get_family_id$batadv-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: lost connection to test machine
suppressed program crash: lost connection to test machine
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-sendmsg$GTP_CMD_DELPDP-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
sendmsg$GTP_CMD_DELPDP(r3, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x38, r4, 0x8, 0x70bd29, 0x25dfdbff, {}, [@GTPA_PEER_ADDRESS={0x8, 0x4, @rand_addr=0x64010102}, @GTPA_MS_ADDR6={0x14, 0xc, @private2}, @GTPA_MS_ADDRESS={0x8, 0x5, @multicast1}]}, 0x38}}, 0x4000000)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, 0x0, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$gtp-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$gtp(&(0x7f0000000180), r3)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r4, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-socket$nl_generic-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r4, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-sendmsg$rds-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
sendmsg$rds(r2, &(0x7f00000005c0)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000540)}, 0x0)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r3, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-bind$rds-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = socket$rds(0x15, 0x5, 0x0)
bind$rds(r2, &(0x7f0000002d00)={0x2, 0x4e21, @loopback}, 0x10)
r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r3, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-socket$rds-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
socket$rds(0x15, 0x5, 0x0)
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r2, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = socket$nl_rdma(0x10, 0x3, 0x14)
r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r2, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$IPCTNL_MSG_TIMEOUT_NEW-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r0, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={0x28, 0x0, 0x8, 0x402, 0x0, 0x0, {0x2, 0x0, 0x8}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x28}, 0x1, 0x0, 0x0, 0x24044804}, 0x14)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r1, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
socket$nl_netfilter(0x10, 0x3, 0xc)
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r1, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
r1 = syz_genetlink_get_family_id$batadv(&(0x7f0000000200), 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r1, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

VM was preempted during syz execution: failed to run command in VM: instance is preempted, retrying
program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
r1 = syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000000280)={&(0x7f0000000240)={0x2c, r1, 0x200, 0x70bd27, 0x25dfdbfd, {}, [@BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000}, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, 0x0, 0x2400c000)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program did not crash
testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program did not crash
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
simplifying guilty program options
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
extracting C reproducer
testing compiled C program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
program crashed: no output from test machine
a never seen crash title: no output from test machine, ignore
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
validation run: crashed=true
testing program (duration=6m0s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_rdma-syz_genetlink_get_family_id$batadv-sendmsg$BATADV_CMD_GET_NEIGHBORS-sendmsg$RDMA_NLDEV_CMD_NEWLINK
detailed listing:
executing program 0:
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
syz_genetlink_get_family_id$batadv(0x0, 0xffffffffffffffff)
sendmsg$BATADV_CMD_GET_NEIGHBORS(0xffffffffffffffff, 0x0, 0x808)
sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)={0x38, 0x1403, 0x1, 0x6, 0x25dfdc01, "", [{{0x9, 0x2, 'syz0\x00'}, {0x8, 0x41, 'rxe\x00'}, {0x14, 0x33, 'ipvlan1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000840}, 0x2400c000)

program crashed: KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
validation run: crashed=true
reproducing took 3h0m50.423223836s
repro crashed as (corrupted=false):
=========================================================
==================================================================
BUG: KASAN: slab-use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:30 [inline]
BUG: KASAN: slab-use-after-free in netdev_lock_ops include/net/netdev_lock.h:41 [inline]
BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x230/0x250 net/ethtool/ioctl.c:463
Read of size 1 at addr ffff8880290c8e09 by task kworker/0:4/5831

CPU: 0 UID: 0 PID: 5831 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events smc_ib_port_event_work
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 netdev_need_ops_lock include/net/netdev_lock.h:30 [inline]
 netdev_lock_ops include/net/netdev_lock.h:41 [inline]
 __ethtool_get_link_ksettings+0x230/0x250 net/ethtool/ioctl.c:463
 __ethtool_get_link_ksettings+0x11f/0x250 net/ethtool/ioctl.c:464
 ib_get_eth_speed+0x180/0x7f0 drivers/infiniband/core/verbs.c:2061
 rxe_query_port+0x93/0x3d0 drivers/infiniband/sw/rxe/rxe_verbs.c:56
 __ib_query_port drivers/infiniband/core/device.c:2304 [inline]
 ib_query_port+0x16e/0x830 drivers/infiniband/core/device.c:2336
 smc_ib_remember_port_attr net/smc/smc_ib.c:364 [inline]
 smc_ib_port_event_work+0x147/0x920 net/smc/smc_ib.c:388
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 13731:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kvmalloc_node_noprof+0x50f/0x820 mm/slub.c:7005
 alloc_netdev_mqs+0xa9/0x12a0 net/core/dev.c:12117
 rtnl_create_link+0x321/0xd70 net/core/rtnetlink.c:3777
 rtnl_newlink_create+0x258/0x7b0 net/core/rtnetlink.c:3959
 __rtnl_newlink net/core/rtnetlink.c:4098 [inline]
 rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4215
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
 __sock_sendmsg net/socket.c:815 [inline]
 __sys_sendto+0x408/0x5a0 net/socket.c:2281
 __do_sys_sendto net/socket.c:2288 [inline]
 __se_sys_sendto net/socket.c:2284 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2284
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 61:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6499 [inline]
 kfree+0x1c5/0x650 mm/slub.c:6792
 device_release+0xc4/0x1f0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x222/0x550 lib/kobject.c:737
 netdev_run_todo+0xeee/0x1060 net/core/dev.c:11818
 default_device_exit_batch+0x6d9/0x760 net/core/dev.c:13290
 ops_exit_list net/core/net_namespace.c:206 [inline]
 ops_undo_list+0x4b4/0x8d0 net/core/net_namespace.c:253
 cleanup_net+0x572/0x810 net/core/net_namespace.c:706
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff8880290c8000
 which belongs to the cache kmalloc-cg-4k of size 4096
The buggy address is located 3593 bytes inside of
 freed 4096-byte region [ffff8880290c8000, ffff8880290c9000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x290c8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff8880290c9011
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b04b500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000300040004 00000000f5000000 ffff8880290c9011
head: 00fff00000000040 ffff88801b04b500 dead000000000100 dead000000000122
head: 0000000000000000 0000000300040004 00000000f5000000 ffff8880290c9011
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13731, tgid 13731 (syz-executor), ts 289270370676
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab+0x7d/0x620 mm/slub.c:3462
 new_slab mm/slub.c:3513 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7410
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __do_kmalloc_node mm/slub.c:5413 [inline]
 __kmalloc_node_track_caller_noprof+0x548/0x720 mm/slub.c:5545
 kmemdup_noprof+0x2b/0x70 mm/util.c:138
 kmemdup_noprof include/linux/fortify-string.h:715 [inline]
 __addrconf_sysctl_register+0xa7/0x4b0 net/ipv6/addrconf.c:7339
 addrconf_sysctl_register+0x168/0x1c0 net/ipv6/addrconf.c:7405
 ipv6_add_dev+0xd5f/0x1400 net/ipv6/addrconf.c:463
 addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3689
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers net/core/dev.c:2327 [inline]
 register_netdevice+0x18a4/0x1eb0 net/core/dev.c:11541
 virt_wifi_newlink+0x3be/0x7c0 drivers/net/wireless/virtual/virt_wifi.c:572
 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3969
page last free pid 13731 tgid 13731 ts 288230448007 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962
 __slab_free+0x274/0x2c0 mm/slub.c:5815
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 __kmalloc_cache_noprof+0x29f/0x600 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 ref_tracker_alloc+0x15b/0x4b0 lib/ref_tracker.c:270
 __netdev_tracker_alloc include/linux/netdevice.h:4532 [inline]
 netdev_hold include/linux/netdevice.h:4561 [inline]
 netdev_queue_add_kobject net/core/net-sysfs.c:1973 [inline]
 netdev_queue_update_kobjects+0x1d1/0x6b0 net/core/net-sysfs.c:2035
 register_queue_kobjects net/core/net-sysfs.c:2098 [inline]
 netdev_register_kobject+0x277/0x350 net/core/net-sysfs.c:2344
 register_netdevice+0x1433/0x1eb0 net/core/dev.c:11503
 veth_newlink+0x4d7/0xdd0 drivers/net/veth.c:1870
 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3969
 __rtnl_newlink net/core/rtnetlink.c:4098 [inline]
 rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4215
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345

Memory state around the buggy address:
 ffff8880290c8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880290c8d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880290c8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff8880290c8e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880290c8f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================

final repro crashed as (corrupted=false):
=========================================================
==================================================================
BUG: KASAN: slab-use-after-free in netdev_need_ops_lock include/net/netdev_lock.h:30 [inline]
BUG: KASAN: slab-use-after-free in netdev_lock_ops include/net/netdev_lock.h:41 [inline]
BUG: KASAN: slab-use-after-free in __ethtool_get_link_ksettings+0x230/0x250 net/ethtool/ioctl.c:463
Read of size 1 at addr ffff8880290c8e09 by task kworker/0:4/5831

CPU: 0 UID: 0 PID: 5831 Comm: kworker/0:4 Not tainted syzkaller #0 PREEMPT(full) 
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
Workqueue: events smc_ib_port_event_work
Call Trace:
 <TASK>
 dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120
 print_address_description+0x55/0x1e0 mm/kasan/report.c:378
 print_report+0x58/0x70 mm/kasan/report.c:482
 kasan_report+0x117/0x150 mm/kasan/report.c:595
 netdev_need_ops_lock include/net/netdev_lock.h:30 [inline]
 netdev_lock_ops include/net/netdev_lock.h:41 [inline]
 __ethtool_get_link_ksettings+0x230/0x250 net/ethtool/ioctl.c:463
 __ethtool_get_link_ksettings+0x11f/0x250 net/ethtool/ioctl.c:464
 ib_get_eth_speed+0x180/0x7f0 drivers/infiniband/core/verbs.c:2061
 rxe_query_port+0x93/0x3d0 drivers/infiniband/sw/rxe/rxe_verbs.c:56
 __ib_query_port drivers/infiniband/core/device.c:2304 [inline]
 ib_query_port+0x16e/0x830 drivers/infiniband/core/device.c:2336
 smc_ib_remember_port_attr net/smc/smc_ib.c:364 [inline]
 smc_ib_port_event_work+0x147/0x920 net/smc/smc_ib.c:388
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
 </TASK>

Allocated by task 13731:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 poison_kmalloc_redzone mm/kasan/common.c:398 [inline]
 __kasan_kmalloc+0x93/0xb0 mm/kasan/common.c:415
 kasan_kmalloc include/linux/kasan.h:263 [inline]
 __do_kmalloc_node mm/slub.c:5414 [inline]
 __kvmalloc_node_noprof+0x50f/0x820 mm/slub.c:7005
 alloc_netdev_mqs+0xa9/0x12a0 net/core/dev.c:12117
 rtnl_create_link+0x321/0xd70 net/core/rtnetlink.c:3777
 rtnl_newlink_create+0x258/0x7b0 net/core/rtnetlink.c:3959
 __rtnl_newlink net/core/rtnetlink.c:4098 [inline]
 rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4215
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
 __sock_sendmsg net/socket.c:815 [inline]
 __sys_sendto+0x408/0x5a0 net/socket.c:2281
 __do_sys_sendto net/socket.c:2288 [inline]
 __se_sys_sendto net/socket.c:2284 [inline]
 __x64_sys_sendto+0xde/0x100 net/socket.c:2284
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Freed by task 61:
 kasan_save_stack mm/kasan/common.c:57 [inline]
 kasan_save_track+0x3e/0x80 mm/kasan/common.c:78
 kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:584
 poison_slab_object mm/kasan/common.c:253 [inline]
 __kasan_slab_free+0x5c/0x80 mm/kasan/common.c:285
 kasan_slab_free include/linux/kasan.h:235 [inline]
 slab_free_hook mm/slub.c:2748 [inline]
 slab_free mm/slub.c:6499 [inline]
 kfree+0x1c5/0x650 mm/slub.c:6792
 device_release+0xc4/0x1f0 drivers/base/core.c:-1
 kobject_cleanup lib/kobject.c:689 [inline]
 kobject_release lib/kobject.c:720 [inline]
 kref_put include/linux/kref.h:65 [inline]
 kobject_put+0x222/0x550 lib/kobject.c:737
 netdev_run_todo+0xeee/0x1060 net/core/dev.c:11818
 default_device_exit_batch+0x6d9/0x760 net/core/dev.c:13290
 ops_exit_list net/core/net_namespace.c:206 [inline]
 ops_undo_list+0x4b4/0x8d0 net/core/net_namespace.c:253
 cleanup_net+0x572/0x810 net/core/net_namespace.c:706
 process_one_work kernel/workqueue.c:3396 [inline]
 process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3479
 worker_thread+0xa47/0xfb0 kernel/workqueue.c:3560
 kthread+0x38b/0x480 kernel/kthread.c:436
 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245

The buggy address belongs to the object at ffff8880290c8000
 which belongs to the cache kmalloc-cg-4k of size 4096
The buggy address is located 3593 bytes inside of
 freed 4096-byte region [ffff8880290c8000, ffff8880290c9000)

The buggy address belongs to the physical page:
page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x290c8
head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
memcg:ffff8880290c9011
flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
page_type: f5(slab)
raw: 00fff00000000040 ffff88801b04b500 dead000000000100 dead000000000122
raw: 0000000000000000 0000000300040004 00000000f5000000 ffff8880290c9011
head: 00fff00000000040 ffff88801b04b500 dead000000000100 dead000000000122
head: 0000000000000000 0000000300040004 00000000f5000000 ffff8880290c9011
head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff
head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008
page dumped because: kasan: bad access detected
page_owner tracks the page as allocated
page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 13731, tgid 13731 (syz-executor), ts 289270370676
 set_page_owner include/linux/page_owner.h:33 [inline]
 post_alloc_hook+0x1f9/0x250 mm/page_alloc.c:1871
 prep_new_page mm/page_alloc.c:1879 [inline]
 get_page_from_freelist+0x2209/0x2280 mm/page_alloc.c:3943
 __alloc_frozen_pages_noprof+0x217/0x5a0 mm/page_alloc.c:5436
 alloc_slab_page mm/slub.c:3347 [inline]
 allocate_slab+0x7d/0x620 mm/slub.c:3462
 new_slab mm/slub.c:3513 [inline]
 refill_objects+0x2d5/0x350 mm/slub.c:7410
 refill_sheaf mm/slub.c:2885 [inline]
 __pcs_replace_empty_main+0x2c8/0x6c0 mm/slub.c:4774
 alloc_from_pcs mm/slub.c:4850 [inline]
 slab_alloc_node mm/slub.c:4984 [inline]
 __do_kmalloc_node mm/slub.c:5413 [inline]
 __kmalloc_node_track_caller_noprof+0x548/0x720 mm/slub.c:5545
 kmemdup_noprof+0x2b/0x70 mm/util.c:138
 kmemdup_noprof include/linux/fortify-string.h:715 [inline]
 __addrconf_sysctl_register+0xa7/0x4b0 net/ipv6/addrconf.c:7339
 addrconf_sysctl_register+0x168/0x1c0 net/ipv6/addrconf.c:7405
 ipv6_add_dev+0xd5f/0x1400 net/ipv6/addrconf.c:463
 addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3689
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 call_netdevice_notifiers_extack net/core/dev.c:2313 [inline]
 call_netdevice_notifiers net/core/dev.c:2327 [inline]
 register_netdevice+0x18a4/0x1eb0 net/core/dev.c:11541
 virt_wifi_newlink+0x3be/0x7c0 drivers/net/wireless/virtual/virt_wifi.c:572
 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3969
page last free pid 13731 tgid 13731 ts 288230448007 stack trace:
 reset_page_owner include/linux/page_owner.h:26 [inline]
 __free_pages_prepare mm/page_alloc.c:1418 [inline]
 __free_frozen_pages+0xc93/0xd90 mm/page_alloc.c:2962
 __slab_free+0x274/0x2c0 mm/slub.c:5815
 qlink_free mm/kasan/quarantine.c:163 [inline]
 qlist_free_all+0x99/0x100 mm/kasan/quarantine.c:179
 kasan_quarantine_reduce+0x148/0x160 mm/kasan/quarantine.c:286
 __kasan_slab_alloc+0x22/0x80 mm/kasan/common.c:350
 kasan_slab_alloc include/linux/kasan.h:253 [inline]
 slab_post_alloc_hook mm/slub.c:4683 [inline]
 slab_alloc_node mm/slub.c:4996 [inline]
 __kmalloc_cache_noprof+0x29f/0x600 mm/slub.c:5559
 _kmalloc_noprof include/linux/slab.h:991 [inline]
 _kzalloc_noprof include/linux/slab.h:1312 [inline]
 ref_tracker_alloc+0x15b/0x4b0 lib/ref_tracker.c:270
 __netdev_tracker_alloc include/linux/netdevice.h:4532 [inline]
 netdev_hold include/linux/netdevice.h:4561 [inline]
 netdev_queue_add_kobject net/core/net-sysfs.c:1973 [inline]
 netdev_queue_update_kobjects+0x1d1/0x6b0 net/core/net-sysfs.c:2035
 register_queue_kobjects net/core/net-sysfs.c:2098 [inline]
 netdev_register_kobject+0x277/0x350 net/core/net-sysfs.c:2344
 register_netdevice+0x1433/0x1eb0 net/core/dev.c:11503
 veth_newlink+0x4d7/0xdd0 drivers/net/veth.c:1870
 rtnl_newlink_create+0x305/0x7b0 net/core/rtnetlink.c:3969
 __rtnl_newlink net/core/rtnetlink.c:4098 [inline]
 rtnl_newlink+0x166d/0x1c30 net/core/rtnetlink.c:4215
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7132
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
 netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1345

Memory state around the buggy address:
 ffff8880290c8d00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880290c8d80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
>ffff8880290c8e00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
                      ^
 ffff8880290c8e80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
 ffff8880290c8f00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
==================================================================