Extracting prog: 50.97413438s
Minimizing prog: 1h16m55.784194701s
Simplifying prog options: 3m51.141157781s
Extracting C: 1m18.417119259s
Simplifying C: 0s


extracting reproducer from 82 programs
first checking the prog from the crash report
single: executing 1 programs separately with timeout 30s
testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-timer_create-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000000500))
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program crashed: WARNING: locking bug in __set_page_owner
single: successfully extracted reproducer
found reproducer with 30 syscalls
minimizing guilty program
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-timer_create-ioctl$BLKTRACESETUP
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r7}, &(0x7f0000000500))
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-timer_create-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r6 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r7, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000000500))
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r6}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program crashed: WARNING: locking bug in __set_page_owner
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
setsockopt$inet6_buf(0xffffffffffffffff, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r7, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r7, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r6})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r6}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r5 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r6 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r7, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r6})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r6}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
shmctl$SHM_STAT(0x0, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r5 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r6 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r7, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r6})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r6}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r4 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r4, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r5 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r6 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r7, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r6})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r6}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
ioctl$VIDIOC_S_SELECTION(0xffffffffffffffff, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r4 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r4, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r5 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r6 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r7, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r6})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r6}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(0xffffffffffffffff, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r3, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r4 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r4, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r5 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r6 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r7, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r6})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r6}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r1, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r3 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r3, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r4 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r5 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r6, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r5})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r5}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r2, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r3, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r4 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r4, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r5 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r6 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r7, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r6})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r6}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r0=>0xffffffffffffffff, <r1=>0xffffffffffffffff})
connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r2 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r2, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r1, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r3 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r3, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r4 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r4, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r5 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r6 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r7, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r6})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r6}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, 0x0, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={0x0}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, 0x0)
connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r1 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r1, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r1, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r2 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r3 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r3, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r4 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r5 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r6, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r4, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r5})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r5}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, 0x0, 0x0)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, 0x0, 0x0, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, 0x0, 0x0)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, 0x0, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(0x0, 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, 0x0, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={0x0}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, 0x0)
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, 0x0)
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, 0x0)
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, 0x0)
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, 0x0)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, 0x0, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(0x0, 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0)
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, 0x0, 0x0)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0), 0x0)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, 0x0)
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, 0x0, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, 0x0)

program did not crash
extracting C reproducer
testing compiled C program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
program did not crash
simplifying guilty program options
testing program (duration=1m5.693118615s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:namespace SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
testing program (duration=1m5.693118615s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_route-sendmsg$nl_route-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-setsockopt$inet6_IPV6_XFRM_POLICY-sched_setattr-openat$vnet-lstat-ioctl$int_in-sendmsg$NFT_BATCH-ioctl$VHOST_SET_LOG_FD-setrlimit-openat$vicodec0-ioctl$VIDIOC_S_SELECTION-prlimit64-timer_create-shmget$private-shmctl$SHM_STAT-timer_settime-syz_open_dev$ndb-gettid-ioctl$BINDER_SET_CONTEXT_MGR_EXT-socket$inet6_tcp-setsockopt$inet6_buf-ioctl$BLKTRACESETUP-timer_create
detailed listing:
executing program 0:
r0 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=@ipv4_newroute={0x2c, 0x18, 0x1, 0x0, 0x0, {0x2, 0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa}, [@RTA_IP_PROTO={0x5, 0x1b, 0x2}, @RTA_DST={0x8, 0x1, @loopback}]}, 0x2c}}, 0x4000000)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@mcast2, @in6=@private1, 0x0, 0x0, 0x4e22, 0x0, 0xa, 0x0, 0x0, 0x33}, {0x80000001, 0x8001, 0x0, 0x0, 0xfffffffffffffffc, 0x2, 0x400}, {0x0, 0x1, 0x0, 0x80000000}, 0x0, 0x0, 0x1, 0x1}, {{@in=@local, 0x2, 0x6c}, 0xa, @in6=@mcast2, 0x0, 0x4}}, 0xe8)
sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0)
r3 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0)
lstat(&(0x7f0000000040)='./file0\x00', 0x0)
ioctl$int_in(r3, 0x40000000af01, 0x0)
sendmsg$NFT_BATCH(r2, &(0x7f0000000480)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000240)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x2}}, [@NFT_MSG_NEWSET={0x28, 0x9, 0xa, 0x6, 0x0, 0x0, {0x3, 0x0, 0x7}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0x1}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x50}, 0x1, 0x0, 0x0, 0x40000}, 0x8041)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000340))
setrlimit(0xf, &(0x7f0000000000)={0x1, 0x3})
r4 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0)
ioctl$VIDIOC_S_SELECTION(r4, 0xc040565f, &(0x7f0000000000)={0x2, 0x0, 0x6, {0xfffffffe, 0xffffffff}})
prlimit64(0x0, 0x0, 0x0, 0x0)
timer_create(0xfffffffffffffffc, 0x0, &(0x7f0000001400))
r5 = shmget$private(0x0, 0x1000, 0x2, &(0x7f0000ffb000/0x1000)=nil)
shmctl$SHM_STAT(r5, 0xd, &(0x7f00000019c0)=""/4096)
timer_settime(0x0, 0x0, &(0x7f000006b000)={{0x0, 0x8}, {0x0, 0x9}}, 0x0)
r6 = syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x141000)
r7 = gettid()
ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, &(0x7f0000000100))
r8 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_buf(r8, 0x29, 0x20, &(0x7f00000000c0)="0bbb268dd6ffa80800000000000000000000210d0000aaa8fa017242ba9380d440fe0000000000002900000002000000", 0xfe60)
ioctl$BLKTRACESETUP(r6, 0xc0481273, &(0x7f0000000380)={'\x00', 0xffff, 0x1ff, 0x4, 0x2, 0x9, r7})
timer_create(0x6, &(0x7f0000000140)={0x0, 0x2e, 0x4, @tid=r7}, &(0x7f00000004c0))

program did not crash
reproducing took 1h22m56.316638281s
repro crashed as (corrupted=false):
=============================
[ BUG: Invalid wait context ]
6.13.0-rc6-syzkaller-00051-geea6e4b4dfb8 #0 Not tainted
-----------------------------
syz.5.208/7007 is trying to lock:
ffffffff8ea6baf8 (stack_list_lock){-.-.}-{3:3}, at: add_stack_record_to_list mm/page_owner.c:182 [inline]
ffffffff8ea6baf8 (stack_list_lock){-.-.}-{3:3}, at: inc_stack_record_count mm/page_owner.c:214 [inline]
ffffffff8ea6baf8 (stack_list_lock){-.-.}-{3:3}, at: __set_page_owner+0x5cb/0x800 mm/page_owner.c:329
other info that might help us debug this:
context-{2:2}
no locks held by syz.5.208/7007.
stack backtrace:
CPU: 1 UID: 0 PID: 7007 Comm: syz.5.208 Not tainted 6.13.0-rc6-syzkaller-00051-geea6e4b4dfb8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4826 [inline]
 check_wait_context kernel/locking/lockdep.c:4898 [inline]
 __lock_acquire+0x15a8/0x2100 kernel/locking/lockdep.c:5176
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
 add_stack_record_to_list mm/page_owner.c:182 [inline]
 inc_stack_record_count mm/page_owner.c:214 [inline]
 __set_page_owner+0x5cb/0x800 mm/page_owner.c:329
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558
 prep_new_page mm/page_alloc.c:1566 [inline]
 get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753
 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2269
 stack_depot_save_flags+0x72d/0x940 lib/stackdepot.c:627
 kasan_save_stack+0x4f/0x60 mm/kasan/common.c:48
 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
 task_work_add+0xd9/0x490 kernel/task_work.c:77
 __run_posix_cpu_timers kernel/time/posix-cpu-timers.c:1223 [inline]
 run_posix_cpu_timers+0x6ac/0x810 kernel/time/posix-cpu-timers.c:1422
 tick_sched_handle kernel/time/tick-sched.c:276 [inline]
 tick_nohz_handler+0x37c/0x500 kernel/time/tick-sched.c:297
 __run_hrtimer kernel/time/hrtimer.c:1739 [inline]
 __hrtimer_run_queues+0x551/0xd30 kernel/time/hrtimer.c:1803
 hrtimer_interrupt+0x403/0xa40 kernel/time/hrtimer.c:1865
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
 __sysvec_apic_timer_interrupt+0x110/0x420 arch/x86/kernel/apic/apic.c:1055
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0033:0x7f3e4d1adb50
Code: 48 8b 3c 25 00 03 00 00 e8 1d 13 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 e7 02 74 0b c3 66 2e 0f 1f 84 00 00 00 00 00 <64> 48 8b 04 25 10 00 00 00 8b 90 08 03 00 00 48 8d b8 08 03 00 00
RSP: 002b:00007f3e4e023b68 EFLAGS: 00000246
RAX: 0000000000000008 RBX: 0000000000141000 RCX: 00007f3e4d184690
RDX: 0000000000141000 RSI: 00007f3e4e023c10 RDI: 0000000000000000
RBP: 00007f3e4e023c10 R08: 0000000000000000 R09: 002364626e2f7665
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3e4d376160 R15: 00007f3e4d49fa28
 </TASK>

final repro crashed as (corrupted=false):
=============================
[ BUG: Invalid wait context ]
6.13.0-rc6-syzkaller-00051-geea6e4b4dfb8 #0 Not tainted
-----------------------------
syz.5.208/7007 is trying to lock:
ffffffff8ea6baf8 (stack_list_lock){-.-.}-{3:3}, at: add_stack_record_to_list mm/page_owner.c:182 [inline]
ffffffff8ea6baf8 (stack_list_lock){-.-.}-{3:3}, at: inc_stack_record_count mm/page_owner.c:214 [inline]
ffffffff8ea6baf8 (stack_list_lock){-.-.}-{3:3}, at: __set_page_owner+0x5cb/0x800 mm/page_owner.c:329
other info that might help us debug this:
context-{2:2}
no locks held by syz.5.208/7007.
stack backtrace:
CPU: 1 UID: 0 PID: 7007 Comm: syz.5.208 Not tainted 6.13.0-rc6-syzkaller-00051-geea6e4b4dfb8 #0
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024
Call Trace:
 <TASK>
 __dump_stack lib/dump_stack.c:94 [inline]
 dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120
 print_lock_invalid_wait_context kernel/locking/lockdep.c:4826 [inline]
 check_wait_context kernel/locking/lockdep.c:4898 [inline]
 __lock_acquire+0x15a8/0x2100 kernel/locking/lockdep.c:5176
 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849
 __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:110 [inline]
 _raw_spin_lock_irqsave+0xd5/0x120 kernel/locking/spinlock.c:162
 add_stack_record_to_list mm/page_owner.c:182 [inline]
 inc_stack_record_count mm/page_owner.c:214 [inline]
 __set_page_owner+0x5cb/0x800 mm/page_owner.c:329
 set_page_owner include/linux/page_owner.h:32 [inline]
 post_alloc_hook+0x1f3/0x230 mm/page_alloc.c:1558
 prep_new_page mm/page_alloc.c:1566 [inline]
 get_page_from_freelist+0x365c/0x37a0 mm/page_alloc.c:3476
 __alloc_pages_noprof+0x292/0x710 mm/page_alloc.c:4753
 alloc_pages_mpol_noprof+0x3e8/0x680 mm/mempolicy.c:2269
 stack_depot_save_flags+0x72d/0x940 lib/stackdepot.c:627
 kasan_save_stack+0x4f/0x60 mm/kasan/common.c:48
 __kasan_record_aux_stack+0xac/0xc0 mm/kasan/generic.c:544
 task_work_add+0xd9/0x490 kernel/task_work.c:77
 __run_posix_cpu_timers kernel/time/posix-cpu-timers.c:1223 [inline]
 run_posix_cpu_timers+0x6ac/0x810 kernel/time/posix-cpu-timers.c:1422
 tick_sched_handle kernel/time/tick-sched.c:276 [inline]
 tick_nohz_handler+0x37c/0x500 kernel/time/tick-sched.c:297
 __run_hrtimer kernel/time/hrtimer.c:1739 [inline]
 __hrtimer_run_queues+0x551/0xd30 kernel/time/hrtimer.c:1803
 hrtimer_interrupt+0x403/0xa40 kernel/time/hrtimer.c:1865
 local_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1038 [inline]
 __sysvec_apic_timer_interrupt+0x110/0x420 arch/x86/kernel/apic/apic.c:1055
 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1049 [inline]
 sysvec_apic_timer_interrupt+0x52/0xc0 arch/x86/kernel/apic/apic.c:1049
 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:702
RIP: 0033:0x7f3e4d1adb50
Code: 48 8b 3c 25 00 03 00 00 e8 1d 13 00 00 66 66 2e 0f 1f 84 00 00 00 00 00 66 90 83 e7 02 74 0b c3 66 2e 0f 1f 84 00 00 00 00 00 <64> 48 8b 04 25 10 00 00 00 8b 90 08 03 00 00 48 8d b8 08 03 00 00
RSP: 002b:00007f3e4e023b68 EFLAGS: 00000246
RAX: 0000000000000008 RBX: 0000000000141000 RCX: 00007f3e4d184690
RDX: 0000000000141000 RSI: 00007f3e4e023c10 RDI: 0000000000000000
RBP: 00007f3e4e023c10 R08: 0000000000000000 R09: 002364626e2f7665
R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000000
R13: 0000000000000000 R14: 00007f3e4d376160 R15: 00007f3e4d49fa28
 </TASK>