Extracting prog: 4m55.816587299s Minimizing prog: 59m39.361747667s Simplifying prog options: 0s Extracting C: 1m56.673965462s Simplifying C: 21m21.783646449s extracting reproducer from 28 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-syz_genetlink_get_family_id$nl80211-ioctl$sock_SIOCGIFINDEX_80211-sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)={0x1c, r1, 0x39, 0x72bd29, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$kcm-sendmsg$kcm detailed listing: executing program 0: r0 = socket$kcm(0x23, 0x2, 0x0) sendmsg$kcm(r0, &(0x7f0000000140)={&(0x7f0000000000)=@phonet, 0x80, 0x0, 0x0, 0x0, 0x4000}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): mmap-mmap-socket$inet_udp-socket$inet_udp-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL-sendmsg$inet-openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_generic-syz_genetlink_get_family_id$tipc-sendmsg$TIPC_CMD_ENABLE_BEARER-ioctl$SIOCSIFHWADDR-socket$unix-socket$nl_route-socket$nl_route-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-openat$tun-openat$tun-close-socket$unix-socket$nl_route-socket$nl_route-ioctl$sock_SIOCGIFINDEX-ioctl$sock_SIOCGIFINDEX-sendmsg$nl_route_sched-sendmsg$nl_route_sched-ioctl$SIOCSIFHWADDR-openat$cgroup_ro-bpf$PROG_LOAD-socket$netlink-socket$netlink-socket$nl_generic-syz_genetlink_get_family_id$tipc2-syz_genetlink_get_family_id$tipc2 detailed listing: executing program 0: mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) (async) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f0000000380)={'sit0\x00', &(0x7f00000005c0)={'tunl0\x00', r1, 0x1, 0x8, 0x5, 0x7, {{0x5, 0x4, 0x3, 0x3b, 0x14, 0x67, 0x0, 0x0, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x10}, @rand_addr=0x64010102}}}}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r5) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x10001, 0x7, 0x6361, 0x5, 0x1, 0x6}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70b923, 0x80001, {0x0, 0x0, 0x0, r9, {}, {0x2, 0xb}, {0x10, 0xb}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0x8, 0x4, 0x3}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0xc874}, 0x4008000) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) (async) r10 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r10) r11 = socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) (async) r12 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@getchain={0x34, 0x66, 0x200, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xd, 0x3}, {0x7, 0xfff3}, {0x5, 0xa}}, [{0x8, 0xb, 0xd}, {0x8, 0xb, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) (async) sendmsg$nl_route_sched(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=@getchain={0x34, 0x66, 0x200, 0x70bd27, 0x25dfdbfb, {0x0, 0x0, 0x0, r2, {0xd, 0x3}, {0x7, 0xfff3}, {0x5, 0xa}}, [{0x8, 0xb, 0xd}, {0x8, 0xb, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$SIOCSIFHWADDR(r10, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) socket$netlink(0x10, 0x3, 0x4) (async) socket$netlink(0x10, 0x3, 0x4) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000006c0), 0xffffffffffffffff) (async) syz_genetlink_get_family_id$tipc2(&(0x7f00000006c0), 0xffffffffffffffff) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-close-openat$tun-close-socketpair$unix-ioctl$SIOCSIFHWADDR-ioctl$SIOCSIFHWADDR-ioctl$HCIINQUIRY-socket$inet6-setsockopt$inet6_MCAST_JOIN_GROUP-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r8) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r9, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r8, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="110000000002"}) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) r10 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r10, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) r11 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r11, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_send_unreach6 single: successfully extracted reproducer found reproducer with 30 syscalls minimizing guilty program testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-close-openat$tun-close-socketpair$unix-ioctl$SIOCSIFHWADDR-ioctl$SIOCSIFHWADDR-ioctl$HCIINQUIRY-socket$inet6-setsockopt$inet6_MCAST_JOIN_GROUP-socket$nl_netfilter detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r8) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r9, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r8, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="110000000002"}) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) r10 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r10, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) socket$nl_netfilter(0x10, 0x3, 0xc) program did not crash testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-close-openat$tun-close-socketpair$unix-ioctl$SIOCSIFHWADDR-ioctl$SIOCSIFHWADDR-ioctl$HCIINQUIRY-socket$inet6-setsockopt$inet6_MCAST_JOIN_GROUP-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r8) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r9, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r8, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="110000000002"}) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) r10 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r10, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program did not crash testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-close-openat$tun-close-socketpair$unix-ioctl$SIOCSIFHWADDR-ioctl$SIOCSIFHWADDR-ioctl$HCIINQUIRY-socket$inet6-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r8) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r9, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r8, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="110000000002"}) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) socket$inet6(0xa, 0x80001, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-close-openat$tun-close-socketpair$unix-ioctl$SIOCSIFHWADDR-ioctl$SIOCSIFHWADDR-ioctl$HCIINQUIRY-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r7, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r8) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r9) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r9, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r8, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="110000000002"}) ioctl$HCIINQUIRY(r6, 0x400448ca, 0x0) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-close-openat$tun-close-socketpair$unix-ioctl$SIOCSIFHWADDR-ioctl$SIOCSIFHWADDR-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r7) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r8, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$SIOCSIFHWADDR(r7, 0x8943, &(0x7f0000002280)={'syzkaller0\x00', @random="110000000002"}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-close-openat$tun-close-socketpair$unix-ioctl$SIOCSIFHWADDR-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r7) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r8, 0x8943, &(0x7f0000000100)={'syzkaller0\x00'}) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-close-openat$tun-close-socketpair$unix-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r7) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r8) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-close-openat$tun-close-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r7) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r8) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-close-openat$tun-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r7) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_send_unreach6 testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-close-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r7) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-openat$tun-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-ioctl$TUNSETIFF-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-openat$tun-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x1c1842, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-openat$tun-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-bpf$BPF_RAW_TRACEPOINT_OPEN-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000180)='kfree\x00'}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_send_unreach6 testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-syz_init_net_socket$bt_hci-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_send_unreach6 testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-bind$packet-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00', 0x0}) bind$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x1a, r5, 0x1, 0xf, 0x6, @multicast}, 0x14) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-ioctl$sock_SIOCGIFINDEX-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'erspan0\x00'}) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_send_unreach6 testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-setsockopt$packet_int-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r4, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_send_unreach6 testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$packet-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) socket$packet(0x11, 0x3, 0x300) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_send_unreach6 testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-bpf$MAP_UPDATE_ELEM_TAIL_CALL-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r1, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r3, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r3, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000002c0)={{r0}, &(0x7f00000001c0), &(0x7f0000000200)=r2}, 0x20) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-bpf$BPF_MAP_CONST_STR_FREEZE-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r0, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="18000000", 0x4) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={0x1}, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-write-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r0, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="18000000", 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-bind$bt_hci-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r0, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-syz_init_net_socket$bt_hci-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r0, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-bpf$PROG_LOAD-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r0, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-getsockopt$sock_buf-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) getsockopt$sock_buf(r0, 0x1, 0x22, &(0x7f0000000040)=""/232, &(0x7f0000000180)=0xe8) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-syz_init_net_socket$bt_hci-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bpf$MAP_CREATE_TAIL_CALL-socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000240)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_send_unreach6 testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) program did not crash testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, 0x0}, 0x0) program did not crash testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0, 0xfc}}, 0x0) program did not crash testing program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB], 0xfc}}, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=45.951996375s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_send_unreach6 simplifying C reproducer testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program did not crash testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program did not crash testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:false Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program did not crash testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:true UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing compiled C program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH program crashed: WARNING in nf_reject_fill_skb_dst testing program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst validation run: crashed=true testing program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst validation run: crashed=true testing program (duration=45.951996375s, {Threaded:false Repeat:false RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-sendmsg$NFT_BATCH detailed listing: executing program 0: r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073797a300000000074000000060a010400000000e5000000010000004c000480240001800b00010072656a656374000014000280080001400000000005000200fc000000240001800b000100736f636b6574000014000280080002400000000a080001400000000208000b40000000000900010073797a300000000014000000110001"], 0xfc}}, 0x0) program crashed: WARNING in nf_reject_fill_skb_dst validation run: crashed=true reproducing took 1h33m31.116227383s repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: CPU: 0 PID: 13 at ./include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: CPU: 0 PID: 13 at ./include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1211 [inline] WARNING: CPU: 0 PID: 13 at ./include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 Modules linked in: CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:skb_dst_check_unset include/linux/skbuff.h:1164 [inline] RIP: 0010:skb_dst_set include/linux/skbuff.h:1211 [inline] RIP: 0010:nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 Code: 8b 0d 60 6e 8b 08 48 3b 8c 24 e0 00 00 00 75 5d 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 03 8a 67 01 cc e8 4d ca aa f7 90 <0f> 0b 90 e9 38 ff ff ff 44 89 f9 80 e1 07 fe c1 38 c1 0f 8c 2b fe RSP: 0018:ffffc90000007360 EFLAGS: 00010246 RAX: ffffffff8a14e1e3 RBX: ffff88802b2b7780 RCX: ffff88801cea8000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000007490 R08: ffffffff8fa37c37 R09: 1ffffffff1f46f86 R10: dffffc0000000000 R11: fffffbfff1f46f87 R12: ffff88807bf10101 R13: dffffc0000000001 R14: 1ffff92000000e70 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888125c1b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffff4c0dba4 CR3: 000000000df36000 CR4: 00000000003526f0 Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] nft_do_chain+0x40c/0x1920 net/netfilter/nf_tables_core.c:285 nft_do_chain_inet+0x25d/0x340 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x206/0x3a0 include/linux/netfilter.h:316 __netif_receive_skb_one_core net/core/dev.c:5979 [inline] __netif_receive_skb+0x143/0x380 net/core/dev.c:6092 process_backlog+0x60e/ final repro crashed as (corrupted=false): ------------[ cut here ]------------ WARNING: CPU: 0 PID: 13 at ./include/linux/skbuff.h:1165 skb_dst_check_unset include/linux/skbuff.h:1164 [inline] WARNING: CPU: 0 PID: 13 at ./include/linux/skbuff.h:1165 skb_dst_set include/linux/skbuff.h:1211 [inline] WARNING: CPU: 0 PID: 13 at ./include/linux/skbuff.h:1165 nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 Modules linked in: CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 Workqueue: ipv6_addrconf addrconf_dad_work RIP: 0010:skb_dst_check_unset include/linux/skbuff.h:1164 [inline] RIP: 0010:skb_dst_set include/linux/skbuff.h:1211 [inline] RIP: 0010:nf_reject_fill_skb_dst+0x2a4/0x330 net/ipv4/netfilter/nf_reject_ipv4.c:234 Code: 8b 0d 60 6e 8b 08 48 3b 8c 24 e0 00 00 00 75 5d 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 03 8a 67 01 cc e8 4d ca aa f7 90 <0f> 0b 90 e9 38 ff ff ff 44 89 f9 80 e1 07 fe c1 38 c1 0f 8c 2b fe RSP: 0018:ffffc90000007360 EFLAGS: 00010246 RAX: ffffffff8a14e1e3 RBX: ffff88802b2b7780 RCX: ffff88801cea8000 RDX: 0000000000000100 RSI: 0000000000000000 RDI: 0000000000000000 RBP: ffffc90000007490 R08: ffffffff8fa37c37 R09: 1ffffffff1f46f86 R10: dffffc0000000000 R11: fffffbfff1f46f87 R12: ffff88807bf10101 R13: dffffc0000000001 R14: 1ffff92000000e70 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888125c1b000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007ffff4c0dba4 CR3: 000000000df36000 CR4: 00000000003526f0 Call Trace: nf_send_unreach+0x17b/0x6e0 net/ipv4/netfilter/nf_reject_ipv4.c:325 nft_reject_inet_eval+0x4bc/0x690 net/netfilter/nft_reject_inet.c:27 expr_call_ops_eval net/netfilter/nf_tables_core.c:237 [inline] nft_do_chain+0x40c/0x1920 net/netfilter/nf_tables_core.c:285 nft_do_chain_inet+0x25d/0x340 net/netfilter/nft_chain_filter.c:161 nf_hook_entry_hookfn include/linux/netfilter.h:158 [inline] nf_hook_slow+0xc5/0x220 net/netfilter/core.c:623 nf_hook include/linux/netfilter.h:273 [inline] NF_HOOK+0x206/0x3a0 include/linux/netfilter.h:316 __netif_receive_skb_one_core net/core/dev.c:5979 [inline] __netif_receive_skb+0x143/0x380 net/core/dev.c:6092 process_backlog+0x60e/