Extracting prog: 3h8m2.174138427s Minimizing prog: 28m55.141264332s Simplifying prog options: 0s Extracting C: 37.334883755s Simplifying C: 48m10.905066567s extracting reproducer from 30 programs testing a last program of every proc single: executing 5 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS-sendmsg$RDMA_NLDEV_CMD_STAT_SET-bind$inet6-sendto$inet6-setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS-mmap-syz_genetlink_get_family_id$netlbl_unlabel-recvfrom$inet6 detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-socket$inet_udplite-setsockopt$EBT_SO_SET_ENTRIES-ioctl$HCIINQUIRY-bind$bt_hci detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-ioctl$sock_SIOCOUTQNSD-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-socket$nl_route-openat$tun-ioctl$TUNSETIFF-bpf$PROG_LOAD-socket$packet-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun-sendmsg-sendmsg$kcm-sendmsg$kcm-syz_init_net_socket$bt_hidp-write$cgroup_subtree-socket$kcm-sendmsg$NFT_BATCH-write$cgroup_subtree detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-sendmmsg$inet6-shutdown-getsockopt$bt_hci-socket$inet6_tcp-listen-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$BPF_PROG_DETACH-bpf$MAP_UPDATE_ELEM-socket$key-sendmsg$key-recvmmsg-socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched-setsockopt$inet6_tcp_int-sendmmsg$sock detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000022c0)='`', 0x1}], 0x1}}, {{&(0x7f0000000900)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, &(0x7f0000003580)=[{&(0x7f0000000940)='z', 0x1}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x1, &(0x7f0000001280)=""/4097, &(0x7f00000000c0)=0x1001) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r3, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r1}, 0x20) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0x18, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x3, 0x12}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}]}, 0x58}}, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000a00)=""/157, 0x9d}], 0x1}}], 0x1, 0x2, 0x0) r5 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4c, 0x2, [@TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_HH_FLOWS_LIMIT={0x8}, @TCA_HHF_NON_HH_WEIGHT={0x8}, @TCA_HHF_EVICT_TIMEOUT={0xfffffffffffffebc}, @TCA_HHF_RESET_TIMEOUT, @TCA_HHF_ADMIT_BYTES={0x8}, @TCA_HHF_EVICT_TIMEOUT={0x8}, @TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_ADMIT_BYTES={0x8}]}}]}, 0x78}}, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000080), 0x4) sendmmsg$sock(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="37718a623f9df45f31dee3a1dc342c86a363751e2b8d5e4f0d4366991cd78e840aa76b6cc4c63fcea7aba2813a20b7a2c7c4bee81f3edbddf68bed731be31afb85e879aadbc214c3dfb7fc9cb0c52bac4ad7d2d4fda74ca2b8385c3e7ef5bb18296e3e7f0e17aee30701bc68474f9fc355cd1d3f69c24a24cbfa0f8b69e8a311ef1d31e4fea8fac084d8cd6eafae5cd7b3d4985cf163bf8067c8b3dbda5a5df6369be1d5db4a30e4", 0xa8}, {&(0x7f0000000040)}, {&(0x7f00000001c0)="fc8c", 0x2}], 0x3, &(0x7f0000000240)=[@timestamping={{0x14, 0x1, 0x25, 0xaa9a}}, @mark={{0x14, 0x1, 0x24, 0x86}}, @txtime={{0x18, 0x1, 0x3d, 0x100000000}}, @timestamping={{0x14}}, @mark={{0x14, 0x1, 0x24, 0x1}}, @timestamping={{0x14, 0x1, 0x25, 0x38}}], 0x90}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="24c95064337c922c8c164da2d3ac1c93dc440b446ea96a429e967870bacdfa317054d2e68e378cd36370896a134615fb817e3ee1c9746f31ca97ad4f8a7c7ea806b5603df4e6412d9586489b60c9a0612d8d8694a965b437e9bae5292baa4f84444c38d895edf2f03c7ffa53d43bbf3e253e26cb4528b68dda1d4a06285c27ae8331185b9e8970d439aff19b61e2c8b669dcd596d47b63cd141b41f2f1a5b6e3c5ec87f43505cd0ec16c05938c9a08e87af6c264b10b2ca3fec32b2f4f454a225639343d7a7c42a39b0edd9e648e2f52bdc5f2e44d1c2b151de2ed1127379e15bd0867", 0xe3}, {&(0x7f0000000400)="2b55df4a0ebc042665f4198c7902a8212ef047ae1c8d9d04becf98ec5e3870bd9c5315d1e677218ca8c9a5a14a3b2513ff8ea328ef9365c6ad75cdab77a0b821f7d4274f29511515b7424ef646dbef4fd56f7b68b22c3e7e072d2d3e0af7281269058740ef17e2067df3a0fea3b401d6", 0x70}, {&(0x7f0000000480)="9d655d0ef05ccfd46889eba5008b91eadfe925bec05089f3c174a57f524d73dc3742009b7d7230c9887ec4bfa45994707bfa7e32afff8a24a25da6b9ed97b43bd2ccc92ae6ec7021d6a09bd5a3220f6f955662aa936c7ba1ad0bc5d013fb58fc3587e8", 0x63}, {&(0x7f0000000500)="f06224d1847875eae4a09b74f15bfb8f21f42b37dc8a1c357b00d98dd25a7d", 0x1f}, {&(0x7f0000000540)="3dd30a9230242dd2862a3cb1ea8d6b32fc722a51373b26656ab3f66015168225fd8b21fc69a607bdb55ecae975b89267f4dec2f8f0256507f1ab41d418c343ab7a7d946b091fbfea6a8cf290f11e1f6fe323b8ac1ef36e5a8f82f0ce144ddab9e06c1460bbcf9c1702611c36039cb5a768f14571ecb490127d290b041ceaa2bcf163d63093022ab5b03f380a2b833813df", 0x91}], 0x5, &(0x7f0000000680)=[@txtime={{0x18, 0x1, 0x3d, 0x5}}, @txtime={{0x18}}], 0x30}}], 0x2, 0x4004004) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket$nl_netfilter-sendmsg$IPCTNL_MSG_EXP_GET-writev-openat$cgroup_devices-write$cgroup_devices-socket$kcm detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000004100)={0x0, 0x0, &(0x7f00000040c0)={&(0x7f0000003f40)={0x38, 0x1, 0x2, 0x301, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @empty}}}]}]}, 0x38}}, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f30000000170a0017e9ffffff040037000900030001632564b7587ed2e7a6b9a64411f6bb744dc48f577c6ea6db125082897bbe546bab98f93551386ebb855ebd0104a1c57c555077d9e9a97cdda034ad1ea13696ea6497c3167f16809f3083e04fa419a65932e04a4c0c629c7c1e30dedc276d834e", 0x89}], 0x1) r2 = openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000100)={'b', ' *:* ', 'rw\x00'}, 0x9) socket$kcm(0x10, 0x2, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 30s testing program (duration=37s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 12, 21, 14, 24, 30, 15, 30, 26, 21, 4, 8, 16, 11, 5, 21, 10, 10, 1, 8, 16, 7, 2, 7, 19, 6, 3, 24, 5, 9] detailed listing: executing program 1: sendmsg$SMC_PNETID_FLUSH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x28, 0x0, 0x0, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'caif0\x00'}]}, 0x28}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x38, r1, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) getsockopt(r0, 0x1, 0x2, &(0x7f00000003c0)=""/165, &(0x7f0000000480)=0xa5) (async) getsockopt(r0, 0x1, 0x2, &(0x7f00000003c0)=""/165, &(0x7f0000000480)=0xa5) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000000)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000308", 0x38, 0x3a, 0x0, @private1, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "5b52ab", 0x0, 0x2b, 0x0, @private0, @private0, [@dstopts={0x88}]}}}}}}}, 0x0) (async) syz_emit_ethernet(0x6e, &(0x7f0000000000)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000308", 0x38, 0x3a, 0x0, @private1, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "5b52ab", 0x0, 0x2b, 0x0, @private0, @private0, [@dstopts={0x88}]}}}}}}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000010000004000018007000600666f00000800080000000000060001000200000008000500000000000c0007000000000000000000080009000000000008000b"], 0x54}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000001800dd8d000000eeff00000002000000000000070000000006001500040000001400168010000880060002800600010000000000"], 0x38}}, 0x0) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e24, 0x20000000, @rand_addr=' \x01\x00'}}, 0x0, 0x0, 0x3, 0x0, "ddfd3b7ed7c6a1c172a987ae5ce3cafd64c9a736831a5912d606798fb75c9981c4b3ac0e06891ff18bc5543ed57215a3c45f9154dfa319e52a15a2b9acf80c07fb1a854dad742eef6187f2304844c296"}, 0xd8) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b40000000000000061116c000000000017000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x4, 0x3e0, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x76, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000140)='mmap_lock_acquire_returned\x00', r4}, 0x10) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) recvmmsg(r5, &(0x7f00000066c0), 0x40000dc, 0x20010040, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x3c, r7, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_KEY={0x20, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee339084eeef16f162471f4"}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}]}]}, 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@newqdisc={0x78, 0x24, 0xf1d, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x2, 0xb5, 0x3, 0x8, 0x6}, 0x1, 0x1, 0xeb, 0x9, 0xd, 0x18, 0xc, 0xe, 0x1, 0x1000, {0x2800, 0x3, 0x0, 0x8, 0xef, 0x9}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x24, 0x2a, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0x3}}}, 0x24}}, 0x0) close(r0) executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000010000000c00050000000000000000000c0002000000000000000000040007800c00080000000000000000000800010000007fff"], 0x90}}, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000080)=@ethtool_ringparam={0x10, 0x0, 0xfffffffc, 0x0, 0x4, 0xf6c, 0x40000000, 0x0, 0xef3d}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r4, &(0x7f0000000300)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) listen(r4, 0xfdff) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000a40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x38, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_KEY={0x1c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "e59e75e84c"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac0d}]}]}, 0x38}}, 0x0) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x608, 0x0, 0x11, 0x148, 0x0, 0x10, 0x570, 0x2a8, 0x2a8, 0x570, 0x2a8, 0x7fffffe, 0x0, {[{{@uncond, 0x10, 0x2f8, 0x360, 0x1c, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x0, 0x9, 0x0, 0x0, 0xffffffff, 0x8}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x0, 0x6, './file0\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x19, 0x0, 0x0, 0x0, 'syz0\x00', 'syz1\x00'}}}, {{@ip={@multicast1, @rand_addr, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_batadv\x00'}, 0x0, 0x1c8, 0x210, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'team_slave_0\x00', {0x459, 0x0, 0x48, 0x0, 0x0, 0x3, 0x2}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@dev, 'macsec0\x00'}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x668) executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000002a00)=ANY=[@ANYBLOB="180200000000000000000000000000008500000018000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000027c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000002700)="e0b9547ed387dbe9abc86f5b7de8", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000004c0)={@cgroup, 0x12, 0x0, 0x80, &(0x7f0000000300)=[0x0], 0x1, 0x0, &(0x7f0000000340)=[0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000540)={0xffffffffffffffff}, 0x4) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000500)={@fallback=r0, r1, 0x24, 0x1c, 0x0, @void, @value=r3, @void, @void, r2}, 0x20) r4 = socket(0x23, 0x5, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) getsockopt$nfc_llcp(r4, 0x113, 0x0, 0x0, 0x692d84746b19a7c5) r7 = socket$packet(0x11, 0x3, 0x300) r8 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r8, 0x11, 0x67, &(0x7f0000000180)=0x7f, 0x4) connect$inet6(r8, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) write(r8, &(0x7f0000000200)="89ba41c97928dec7cec15a160d3dba257872aed129d4b5247c9834550448a4f46c37425b873ec95db3d757e8b2333a64d9abf416fd83f942661c47bcdf71f7d07ba2b2f051829a7f66952e57962614db0d03474a4a4bce636ea8d2b882b2b49ef18e76edbec7302a96e41f206d930eda2769c56e6d5e3d541ce9a21c3ce5cb5f", 0x80) setsockopt$packet_int(r7, 0x107, 0x8, &(0x7f0000000080)=0x4, 0x4) recvmmsg(r7, &(0x7f0000006580)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x98, r10, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@beacon=[@NL80211_ATTR_IE_ASSOC_RESP={0x0, 0x80, [@sec_chan_ofs={0x3e, 0x0, 0x2}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_TX_RATES={0x2c, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x8}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x0, 0x4, 0x2}]}]}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x98}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@bridge_newneigh={0x30, 0x1c, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x5e}, [@NDA_DST_IPV6={0x14, 0x1, @private2}]}, 0x30}}, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x11f, 0x0, 0x0, 0xfffff010}, {0x7, 0x0, 0x14}]}, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r4, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x2, 0x77}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0x34}, 0x1, 0x0, 0x0, 0x400040d1}, 0x488c0) executing program 4: syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) shutdown(r1, 0x1) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f00000007c0)="2681", 0x2}], 0x1}}], 0x1, 0x4048841) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x5, 0x0, 0x0, {}, {0x77359400}, {}, 0x2, @can={{}, 0x0, 0x3, 0x0, 0x0, "3fd31340e92c4bb8"}}, 0x48}, 0x300}, 0x0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000e4ff0000000000020202000900030073797a32000000000500040002000000090001"], 0x34}, 0x1, 0x40030000000000}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$sock_int(r5, 0x1, 0x2e, &(0x7f00000000c0)=0x101, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r5, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}], 0x1c) setsockopt(r5, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) recvmsg(r5, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000002c0)) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'team_slave_0\x00', 0x0}) r9 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000200)={'netdevsim0\x00', 0x0}) r11 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x14, '\x00', r10, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c00000010000100"/20, @ANYRES32=r8, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r11], 0x2c}}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000300)={0x0, @broadcast, @empty}, &(0x7f0000000340)=0xc) bpf$OBJ_GET_MAP(0x7, &(0x7f00000004c0)=@o_path={&(0x7f0000000480)='./file0\x00', 0x0, 0x10, r6}, 0x18) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, 0x0) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000280)={0x28, 0x0, 0xffffffff, @hyper}, 0x10) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f00000003c0)={@remote, 0x1c}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth1_to_bond\x00', &(0x7f00000006c0)=@ethtool_per_queue_op={0x4b, 0xe, [0x2, 0x5, 0x5, 0x0, 0x4, 0xb, 0x401, 0x7, 0x0, 0x0, 0x3, 0x8000, 0x3, 0x401, 0x5, 0x9, 0x5, 0x9, 0x9, 0x0, 0x7, 0x0, 0x3, 0xfffffff7, 0x0, 0xe, 0xe87, 0x10001, 0x1, 0x3, 0x0, 0x200, 0xc83, 0x1, 0xfffffffc, 0x6, 0xac79, 0x7, 0x6, 0x3, 0x4, 0xea, 0x0, 0x120000, 0x2, 0x6, 0x8, 0x2, 0x0, 0x7fff, 0x1, 0x1, 0xaf, 0x10000, 0xf42, 0x6, 0x81, 0xcd02, 0xb2df, 0x1, 0x6, 0x7, 0x5, 0x0, 0x2, 0x3, 0x400, 0x7fffffff, 0x6, 0x10000, 0x8, 0xdf, 0x10, 0x6a, 0x2, 0x6, 0x7, 0x40, 0x4adf, 0x7, 0x9, 0x9, 0x0, 0x4, 0x2, 0x8, 0x9, 0x6, 0x9, 0x8, 0xe, 0x1, 0xd, 0x0, 0x81e0, 0xf, 0x400, 0x4, 0x9, 0x2, 0x1, 0x3, 0x8, 0x4, 0x2, 0x6, 0xdaa, 0x5, 0xf9, 0x401, 0x1, 0x10001, 0x1, 0x1, 0x3f, 0x101, 0x4, 0x5da, 0xfff, 0x9, 0x7, 0x4, 0xee59, 0x4f65, 0x9, 0x9, 0x4267, 0x3], "b86ba95bff26a4ab277f85cebec2b98886ba70d6cdcf4dc9d4b783ce07a4f02e0d3a9f7819be11d953c2deca579d0ae75da58e634dd14874b358236d0db5204164940589475344d10610bb9b03daac10a2b44e5674c5063289af9d28011971b2cb38f1e237eaf70937d2"}}) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002"], 0x110) setsockopt$inet_group_source_req(r2, 0x0, 0x2c, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @broadcast}}, {{0x2, 0x0, @private=0xa010101}}}, 0x108) setsockopt$inet_group_source_req(r2, 0x0, 0x2b, &(0x7f0000000000)={0x5, {{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x4e20, @multicast1}}}, 0x108) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='freezer.self_freezing\x00', 0x0, 0x0) ioctl$PPPIOCCONNECT(r3, 0x4004743a, &(0x7f0000000240)=0x1) executing program 3: r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000000200)=[{{&(0x7f0000000040)={0x2, 0x0, @empty}, 0x10, 0x0}}, {{&(0x7f0000000000)={0x2, 0x0, @empty=0x3000000}, 0x10, 0x0}}], 0x2, 0x0) (async) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000008112a2000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$netlink(r1, 0x10e, 0xa, &(0x7f0000000000)=""/97, &(0x7f0000000140)=0x61) (async) r2 = socket$inet6(0xa, 0x2, 0x0) (async, rerun: 32) sendto$phonet(0xffffffffffffffff, &(0x7f0000000540)="30a9ccac9ba5d5443128c891c5cdb485c1cd57b9bda8e4a7c1eafc28d4d8e7e2ecc52872519fefe1c8f404d8a5a2a049e9d1a0c569fe0fe9c73d31994f6f9f9e80add86cf885f87ef81018466a3b7540cd34f9e960c8ab0f9281f689fcda4833f5f23274e9cdeb", 0x67, 0x60044014, &(0x7f0000000600)={0x23, 0xac, 0xb, 0x9}, 0x10) (rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x38, r4, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000280)={{{@in=@remote, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x0, 0x16}}, {{@in6=@empty, 0x0, 0x2b}, 0x0, @in6=@mcast2}}, 0xe8) (async, rerun: 32) r5 = socket$key(0xf, 0x3, 0x2) (rerun: 32) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f00000001c0), 0x4) (async) sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) (async) sendmsg$key(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) (async) r6 = socket$netlink(0x10, 0x3, 0x6) writev(r6, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23ffbf510040041feff5aff2b0000000000000700"/68, 0x44}, {&(0x7f0000000080)="c1130389", 0x4}], 0x2) (async, rerun: 64) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) (rerun: 64) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000900)=@newsa={0x184, 0x10, 0x1, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@local, 0x0, 0x0, 0x2000, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in=@multicast1, 0x0, 0x6c}, @in=@empty, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, {0x0, 0x4}, {}, 0x0, 0x0, 0x2, 0x1, 0x6}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @algo_aead={0x4c, 0x12, {{'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x0, 0x80}}]}, 0x184}}, 0x0) (async) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7b, 0x4) bind$inet(r8, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) (async) sendto$inet(r8, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) (async) setsockopt$sock_int(r8, 0x1, 0x8, &(0x7f0000000600), 0x4) (async) sendto$inet(r8, &(0x7f0000000700)="0c268a927f1f6588b967481241ba00600a34f65ac618ded8974897abeaf4b48344ab4ea6f7c555d88fecf90b037511bf746bec66ba", 0x35, 0x0, 0x0, 0x0) (async) recvmsg(r8, &(0x7f0000001500)={0x0, 0xa, &(0x7f0000002200)=[{&(0x7f00000035c0)=""/4106, 0x437aba2}], 0x1, 0x0, 0x46, 0x407006}, 0x104) setsockopt$inet_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f0000000380)='highspeed\x00', 0xa) executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket(0x22, 0x2, 0x3) getsockopt$packet_buf(r2, 0x107, 0x1, &(0x7f0000000240)=""/1, &(0x7f0000002180)=0x1) sendmsg$nl_xfrm(r1, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000a40)=ANY=[@ANYBLOB="6001000010000100000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb0000fff720000001000000003b000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="64010102000000000000000000000000000000006c000000ac1414bb00000000000000000000000000000000000000000000008000000000000000000000000000000000000000000300000000000000000000000000000004000000000000e3ff000000000000000000000000000000040000000000000000000040000000000000000000000000000000ba9b55090000000000fcffffff0000000002000001000000000000000008001f0004000000480003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000008001f0003000000150008"], 0x160}}, 0x4810) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = gettid() ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f00000000c0)=r4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xf, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000023762edd35eaff10dcf502ededdaf4fcf9c0277f25470a209eef60517864e9b22c641f47b842b055bc37f7bdec65f11f2d929f9fa31a5ae8ac8bf9ccb57e8e926d2ecf7402b101cedd0de2d07b76bdc76923af38bd00141ec22689f9302f41069e3340f20dc912eba8b3fa49afd0b2bb65600babf555505935938b4c44f13d790352fed3ccbc8ed27c9933b0514b1227efc915531996d87aee1bd0790700000000000000f450411ca55a3fda77190ab66f04e250b6b036dfde", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r6, 0x6, 0x3, &(0x7f0000000000)=0xc, 0x4) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0xa43, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r7 = accept4(r5, 0x0, 0x0, 0x0) sendmsg(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000380)="c130c435606b4e717ef9bcc0cb7cabc7029b4bc69e569bf13444be4593a12d83cff6cd2e2a767120cbf6405d5affc464e80d2abfa71bdad4d21a38e3294f60cc6bac3f725ae6b55723534dda54abf2254dc1e6aa96d263f5bde938c887292d36b72ec94b3934b96a8cec477adaaf6d4c3e437aa4d1251a15b5b5c1f3eae74bed98cf50aef2869f5360598077ea324263000beaa4e70f4f4f07511152439f397949270bb9ba6b276156e7fa81f0af3e1f0bad6305e8e122c1158b23fd46f0c5f3f2b8310b03b0ace1dd70307b226e432b2c8c819676d506c88522dcbee0266dacbf1bb481482a86be7b686d904e3858ff", 0xf0}], 0x1}, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x7) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r7) r8 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r8, 0x89fb, &(0x7f0000000940)={'sit0\x00', &(0x7f0000000900)={@private2, @empty, 0x10, 0xd}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000280)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018020000", @ANYRESDEC=r7, @ANYBLOB="0000000000000000660002000000000018000000ffffffd000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b00000008000000040000000400000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00 \x00'/28], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000040)={r0}, 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f00000004c0)) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r0, &(0x7f0000000340)="ac9198ef219f7c9fff52e82d1774e900e1fd6214179d4ff06dea2ddca0d4f6a1d2adf1ccb1f058a1eaa38172e0a6222914a7da242f104cacaa8c886e47cf1550660356b738b5bf32d0db2f77da5ec035c649b706ed53831fdd1448aae431f38ded71fa89a87a07e9f2d794668662ca8326358b15fdc376f8abc33b2b413f0cf6f6deb51601a51265b0ec85cc9c6747d29e7f51d8c7c52074eba2a6ddb6584dba878e8baa8b67fafbbbfa6119f75e3f", &(0x7f0000000400)=""/146}, 0x20) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f00000001c0)={'veth1_virt_wifi\x00', @local}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket(0x8, 0x2, 0xc) getsockname$packet(r4, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0xb, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x88eadb6ac961f7c6}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r6, &(0x7f0000002c00)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000002680)="d7", 0xfffffff9}], 0x1, &(0x7f0000003280)=ANY=[], 0x550}, 0x0) sendmmsg(r6, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x240028c1) socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000080)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="2bfafdffffff000000b30700000008002300", @ANYRES32=r8, @ANYBLOB="0800050007000000140004006e696376663000"/28], 0x38}}, 0x0) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), r0) sendmsg$IEEE802154_LLSEC_LIST_DEV(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r1, 0x321}, 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000000079108700000000001e000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) executing program 2: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000cc0)=@delchain={0x198, 0x65, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x4, 0x9}, {0x0, 0xb}}, [@TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @TCA_CHAIN={0x8}, @filter_kind_options=@f_route={{0xa}, {0x150, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0xffff, 0xd}}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0x134, 0x6, [@m_nat={0x84, 0x20, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @rand_addr, @loopback}}]}, {0x31, 0x6, "3eaed48f5023f5c36bc9d8619f3e2af20800000000000000a40bc384135c74eb813bf1cf69dbeaddd76b564e92"}, {0xc}, {0xc}}}, @m_connmark={0x40, 0x0, 0x0, 0x0, {{0xd}, {0x4}, {0xd, 0x6, "66396e732cf67237ec"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_bpf={0x6c, 0x0, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6}]}, {0x3b, 0x6, "ca8fd735f4c425bd44291fa86781920ab90ff95c64e3d33704248d0546950f6c3113358c2551981c52f5a6dd8a3891697d8ab8d8f56d15"}, {0xc}, {0xc}}}]}]}}]}, 0x198}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@gettclass={0x24, 0x2a, 0x10, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xc, 0xa}, {0x10, 0xc}, {0x1, 0xb}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a0b0400000000000000000200000048000480440001800c0001007061796c6f616400340002800800054000000000080002400000000008000440000000000800034000000000080008400400000008000740000000000900010073797a30000000000900020073797a32"], 0x9c}}, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc000000850000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc000000850000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = socket(0x10, 0x3, 0x0) connect$netlink(r1, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x1}, 0xc) r2 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) (async) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000020c0)=@newqdisc={0x58, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7, 0x80, 0x0, 0x1000, 0x2, 0x7fffffff, 0x10088}}, {0x4}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x8800}, 0x0) connect$packet(r1, &(0x7f0000000180)={0x11, 0x1a, r4, 0x1, 0xf, 0x6, @broadcast}, 0x14) (async) connect$packet(r1, &(0x7f0000000180)={0x11, 0x1a, r4, 0x1, 0xf, 0x6, @broadcast}, 0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2300, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x2c, 0x1d, 0xa, 0x805, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0x74}}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) executing program 2: setsockopt(0xffffffffffffffff, 0x84, 0x81, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x1c0, 0xc8, 0x8, 0x0, 0x5803, 0x320, 0x2e8, 0x2e8, 0x320, 0x2e8, 0x3, 0x0, {[{{@ipv6={@remote, @empty, [], [], 'vlan0\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1c0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1, 0x6}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@ipv6header={{0x28}}, @common=@eui64={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x2, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r2) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac1414aa00000000000000001400020002000000e000000200000000000004000d0001007564703a73"], 0x54}}, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "000005", 0x14, 0x6, 0x0, @private0, @mcast1={0xff, 0x10}, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000080)) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r1, @ANYBLOB="db1d88550ca4406693d6b64e9ec37be08d3159073be620db49c84bad3d96755c115d573ca22ae33db16a94afca6ac6516453070913106c4006cfc85ebe1224712df4de6c38a068580a0679879631978a7ad6ccd76147185d50367e551eabc1fe7142401543fd2e7e4f88bcfa946d1b4f48790efd4119da38e772b4d8464470fcd9878d2c3265cd0b5a0d57ed08bfd8f6435ef247341f1ed1368acc9acc97e76a98ccbb711546"], 0x38}}, 0x0) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r1) (async) r2 = socket$unix(0x1, 0x2, 0x0) connect$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000340), 0x4) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000440)=0x82, 0x49) (async) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) (async) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x3f) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x1000001, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x4, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000dd0a0000000000006301410000000000950000004d000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x300, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r4 = openat$cgroup_devices(r3, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB='c 122', @ANYRESHEX], 0xa) (async) r5 = socket$l2tp6(0xa, 0x2, 0x73) sendto$l2tp6(r5, 0x0, 0x0, 0x4008814, &(0x7f0000000100)={0xa, 0x0, 0x8, @private1}, 0x20) sendto$inet(r0, &(0x7f0000000480)="fbbf0b5044e308cb7bd572aa2b42e9678bcf30eff9f3aed14dc94a114bd2b45956aebe2b108a87e865501a5f9e0383611afdd3f8bac3d5cfd7772a3ab48d0ba4b600731e357e38716c449fae7c28548a4f2105f44b8fd9b33041270ae01f1a405e3f650fc3b0926d481c364fca00000000000000006d3a3ede9fc738b8d86209c060161d5ddb5fcf3d09001117cdb9d055aa2d89fe3458720724853a876448d4a1fe9ef0569ad98a05ab5df763923b4e2c576e00000000000000000000000000000000002090666159e3075f7244cf4ec3d7814c0c934f44e200219e6dd7bc23397d5f2f2c76a5baddd0fd8c340362691ef226f7a0ac51b74b6be5ed6737948514cd466943d08eeb3895b80499da2b209da4f3ec5e3744ce3e863b0e04d0ec2f39edf50b6e08c4b47e448a35414763d687fbe3792ee15c5b9791310a346472723c100bf77a310b0ced8004b5ac6d48c40439f512e8ef34a53d65f55563f68136a577736ca5f6f66e01ef4ec2cdc8db34f6de50713adaa3f70189958263fddc1314f8a28ccdef6e1390c5fbaeadc3035d019f0dc75de307de6c0d010000000000000027083d1d5b4b013c503b863b560688d94de886b6dc73d5da2dfeff4bed1a49a975a6c8dbb480e4415ddca5657a5a8e3b111015499e952bb5e8d8f60de3d688df7802c6e8b27b31fac4e199038b79a3999920e634a5af162a9581b0e6647e410700246548234acacf9cb43ab332a37bbc926c39897395c974fda31536be523bf4260300730ae6136fecae5f0fa6ab2df8d98128b24589e3bbe5230e07dc5e0d65cc397e3f8204d48e59e8e294a6d7008ba8fba28cd5009fe1a7c569ce740078bf1c7389a6ba0f89257f0eac417aac0d2d89b05ee5dafa2f1d936c87264d077b2c0d5abdbc64ce943f895dd4c2e9dd7393543d89b00dc6b3a25045d4ec932366c67dfad087fa8dc104644828440bdf67dd97ebccb3bd", 0xfffffea5, 0xc000, 0x0, 0xfffffcef) (async) recvmsg(r0, &(0x7f00000033c0)={&(0x7f00000003c0)=@ethernet={0x0, @dev}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000080)=""/46, 0x31}, {&(0x7f00000021c0)=""/4087, 0x1000}, {&(0x7f0000000f80)=""/4096, 0xfffffffffffffe12}, {&(0x7f0000000280)=""/102, 0x66}], 0x4, &(0x7f0000001f80)=""/178, 0xb2}, 0x10120) (async) sendmsg$unix(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000140)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000800), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r0, @ANYBLOB="000000004540ad18a4661c2f407b9c4fcebad02fb2c7d2e50aac244f79a9a13b0fbc5ad117f44b643feb63a8221b083ca83b4e54552af30275f13b19b99e403ec58429d977d953d0ceaaa161bca3904e7640ab8316e4c00e71d3669857db2c968be3418d5a645f490997bbfbcb9d47a399ef4653f889741c006c1a76f257257913699156ef44a988083cac80cf5c249f8c8852bc42024de815ab3e"], 0x28, 0x4}, 0x48900) executing program 0: r0 = socket(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x10000000, 0x1, 0x7}}]}}]}, 0x44}}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000240)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000280)={r4, 0x11, 0x6, @local}, 0x10) (async) close(r3) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@getaddr={0x14, 0x16, 0x10, 0x70bd25, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x48001) executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="3b000000010006", 0x7) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x2, 0x2, 0x0, 0x3, 0x11, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}, @sadb_x_sa2={0x2, 0x9}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @sadb_x_sec_ctx={0x1, 0x18, 0x4}]}, 0x88}}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) (async) write(r0, &(0x7f0000000000)="3b000000010006", 0x7) (async) socket$key(0xf, 0x3, 0x2) (async) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x2, 0x2, 0x0, 0x3, 0x11, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}, @sadb_x_sa2={0x2, 0x9}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @sadb_x_sec_ctx={0x1, 0x18, 0x4}]}, 0x88}}, 0x0) (async) executing program 3: bind$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4a23}, 0xffffff52) executing program 0: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r1, &(0x7f0000000180)="c2", 0x1, 0x24004400, &(0x7f0000000000)={0xa, 0x2, 0x0, @loopback}, 0x1c) shutdown(r1, 0x1) sendmmsg$inet6(r1, &(0x7f0000001040)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001700)='\x00', 0x1}], 0x1}}], 0x1, 0x80) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x60, r0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x2c, 0x51, 0x0, 0x1, [{0x80, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "02d0e86cbe4d68f75ce39f0dab"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac09}, @NL80211_KEY_IDX={0x5}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x60}}, 0x0) executing program 4: r0 = socket(0x2, 0x3, 0xff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan0\x00', 0x0}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @broadcast}, 0x10) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000200)={r1, 0x3, 0x6}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x30, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x30}}, 0x0) socket(0x2, 0x3, 0xff) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan0\x00'}) (async) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @broadcast}, 0x10) (async) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000200)={r1, 0x3, 0x6}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x30, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x30}}, 0x0) (async) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000004100)={0x0, 0x0, &(0x7f00000040c0)={&(0x7f0000003f40)={0x38, 0x1, 0x2, 0x301, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @empty}}}]}]}, 0x38}}, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f30000000170a0017e9ffffff040037000900030001632564b7587ed2e7a6b9a64411f6bb744dc48f577c6ea6db125082897bbe546bab98f93551386ebb855ebd0104a1c57c555077d9e9a97cdda034ad1ea13696ea6497c3167f16809f3083e04fa419a65932e04a4c0c629c7c1e30dedc276d834e", 0x89}], 0x1) r2 = openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000100)={'b', ' *:* ', 'rw\x00'}, 0x9) socket$kcm(0x10, 0x2, 0x0) executing program 4: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)={0x108, 0x2c, 0x1, 0x0, 0x0, "", [@generic="d447ec83996c742d2879d6f82b672953c4d108d89a0a34d1da826756b314505a6de4c35c903500ea24092f972070b9b26899ae6ccbe3540e575a9a0043356abcd457456d69b5a8652d0a23b9ff427b2a59351cc877562f7bafa5a29b0ff9de83e051b6512bdd460ffd7f93c4af3b1bc164fe4350d9bc7d38983b56664980540c9e70557bde18a53cb4ebc30ad451f7b0845448441a2fb9b551358a535349101f9ff708cc3c8da103302f23fbcdc66535a3354b5ab32f63b520ad7b03bfe1167c4a037ca59942b8cb7a39005557cbd86f17e5be6f3d6863eb4a15c530581c44fc790cd85fe06f46c7b71e56eae90da5fae7398f9a", @nested={0x4, 0x19}]}, 0x108}], 0x1}, 0x0) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x65, &(0x7f00000019c0)=0x1, 0x4) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f0000000000), 0x8) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0xe20, 0x0, @local}, 0x1c) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x40d, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x680de}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}]}, 0x34}}, 0x0) executing program 2: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000022c0)='`', 0x1}], 0x1}}, {{&(0x7f0000000900)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, &(0x7f0000003580)=[{&(0x7f0000000940)='z', 0x1}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x1, &(0x7f0000001280)=""/4097, &(0x7f00000000c0)=0x1001) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r3, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r1}, 0x20) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0x18, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x3, 0x12}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}]}, 0x58}}, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000a00)=""/157, 0x9d}], 0x1}}], 0x1, 0x2, 0x0) r5 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4c, 0x2, [@TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_HH_FLOWS_LIMIT={0x8}, @TCA_HHF_NON_HH_WEIGHT={0x8}, @TCA_HHF_EVICT_TIMEOUT={0xfffffffffffffebc}, @TCA_HHF_RESET_TIMEOUT, @TCA_HHF_ADMIT_BYTES={0x8}, @TCA_HHF_EVICT_TIMEOUT={0x8}, @TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_ADMIT_BYTES={0x8}]}}]}, 0x78}}, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000080), 0x4) sendmmsg$sock(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="37718a623f9df45f31dee3a1dc342c86a363751e2b8d5e4f0d4366991cd78e840aa76b6cc4c63fcea7aba2813a20b7a2c7c4bee81f3edbddf68bed731be31afb85e879aadbc214c3dfb7fc9cb0c52bac4ad7d2d4fda74ca2b8385c3e7ef5bb18296e3e7f0e17aee30701bc68474f9fc355cd1d3f69c24a24cbfa0f8b69e8a311ef1d31e4fea8fac084d8cd6eafae5cd7b3d4985cf163bf8067c8b3dbda5a5df6369be1d5db4a30e4", 0xa8}, {&(0x7f0000000040)}, {&(0x7f00000001c0)="fc8c", 0x2}], 0x3, &(0x7f0000000240)=[@timestamping={{0x14, 0x1, 0x25, 0xaa9a}}, @mark={{0x14, 0x1, 0x24, 0x86}}, @txtime={{0x18, 0x1, 0x3d, 0x100000000}}, @timestamping={{0x14}}, @mark={{0x14, 0x1, 0x24, 0x1}}, @timestamping={{0x14, 0x1, 0x25, 0x38}}], 0x90}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="24c95064337c922c8c164da2d3ac1c93dc440b446ea96a429e967870bacdfa317054d2e68e378cd36370896a134615fb817e3ee1c9746f31ca97ad4f8a7c7ea806b5603df4e6412d9586489b60c9a0612d8d8694a965b437e9bae5292baa4f84444c38d895edf2f03c7ffa53d43bbf3e253e26cb4528b68dda1d4a06285c27ae8331185b9e8970d439aff19b61e2c8b669dcd596d47b63cd141b41f2f1a5b6e3c5ec87f43505cd0ec16c05938c9a08e87af6c264b10b2ca3fec32b2f4f454a225639343d7a7c42a39b0edd9e648e2f52bdc5f2e44d1c2b151de2ed1127379e15bd0867", 0xe3}, {&(0x7f0000000400)="2b55df4a0ebc042665f4198c7902a8212ef047ae1c8d9d04becf98ec5e3870bd9c5315d1e677218ca8c9a5a14a3b2513ff8ea328ef9365c6ad75cdab77a0b821f7d4274f29511515b7424ef646dbef4fd56f7b68b22c3e7e072d2d3e0af7281269058740ef17e2067df3a0fea3b401d6", 0x70}, {&(0x7f0000000480)="9d655d0ef05ccfd46889eba5008b91eadfe925bec05089f3c174a57f524d73dc3742009b7d7230c9887ec4bfa45994707bfa7e32afff8a24a25da6b9ed97b43bd2ccc92ae6ec7021d6a09bd5a3220f6f955662aa936c7ba1ad0bc5d013fb58fc3587e8", 0x63}, {&(0x7f0000000500)="f06224d1847875eae4a09b74f15bfb8f21f42b37dc8a1c357b00d98dd25a7d", 0x1f}, {&(0x7f0000000540)="3dd30a9230242dd2862a3cb1ea8d6b32fc722a51373b26656ab3f66015168225fd8b21fc69a607bdb55ecae975b89267f4dec2f8f0256507f1ab41d418c343ab7a7d946b091fbfea6a8cf290f11e1f6fe323b8ac1ef36e5a8f82f0ce144ddab9e06c1460bbcf9c1702611c36039cb5a768f14571ecb490127d290b041ceaa2bcf163d63093022ab5b03f380a2b833813df", 0x91}], 0x5, &(0x7f0000000680)=[@txtime={{0x18, 0x1, 0x3d, 0x5}}, @txtime={{0x18}}], 0x30}}], 0x2, 0x4004004) executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updsa={0x104, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private0, @in=@multicast2}, {@in6=@local, 0x1, 0x3c}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in6=@dev}]}, 0x104}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS-sendmsg$RDMA_NLDEV_CMD_STAT_SET-bind$inet6-sendto$inet6-setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS-mmap-syz_genetlink_get_family_id$netlbl_unlabel-recvfrom$inet6 detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-socket$inet_udplite-setsockopt$EBT_SO_SET_ENTRIES-ioctl$HCIINQUIRY-bind$bt_hci detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-ioctl$sock_SIOCOUTQNSD-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-socket$nl_route-openat$tun-ioctl$TUNSETIFF-bpf$PROG_LOAD-socket$packet-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun-sendmsg-sendmsg$kcm-sendmsg$kcm-syz_init_net_socket$bt_hidp-write$cgroup_subtree-socket$kcm-sendmsg$NFT_BATCH-write$cgroup_subtree detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-sendmmsg$inet6-shutdown-getsockopt$bt_hci-socket$inet6_tcp-listen-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$BPF_PROG_DETACH-bpf$MAP_UPDATE_ELEM-socket$key-sendmsg$key-recvmmsg-socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched-setsockopt$inet6_tcp_int-sendmmsg$sock detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000022c0)='`', 0x1}], 0x1}}, {{&(0x7f0000000900)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, &(0x7f0000003580)=[{&(0x7f0000000940)='z', 0x1}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x1, &(0x7f0000001280)=""/4097, &(0x7f00000000c0)=0x1001) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r3, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r1}, 0x20) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0x18, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x3, 0x12}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}]}, 0x58}}, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000a00)=""/157, 0x9d}], 0x1}}], 0x1, 0x2, 0x0) r5 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4c, 0x2, [@TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_HH_FLOWS_LIMIT={0x8}, @TCA_HHF_NON_HH_WEIGHT={0x8}, @TCA_HHF_EVICT_TIMEOUT={0xfffffffffffffebc}, @TCA_HHF_RESET_TIMEOUT, @TCA_HHF_ADMIT_BYTES={0x8}, @TCA_HHF_EVICT_TIMEOUT={0x8}, @TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_ADMIT_BYTES={0x8}]}}]}, 0x78}}, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000080), 0x4) sendmmsg$sock(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="37718a623f9df45f31dee3a1dc342c86a363751e2b8d5e4f0d4366991cd78e840aa76b6cc4c63fcea7aba2813a20b7a2c7c4bee81f3edbddf68bed731be31afb85e879aadbc214c3dfb7fc9cb0c52bac4ad7d2d4fda74ca2b8385c3e7ef5bb18296e3e7f0e17aee30701bc68474f9fc355cd1d3f69c24a24cbfa0f8b69e8a311ef1d31e4fea8fac084d8cd6eafae5cd7b3d4985cf163bf8067c8b3dbda5a5df6369be1d5db4a30e4", 0xa8}, {&(0x7f0000000040)}, {&(0x7f00000001c0)="fc8c", 0x2}], 0x3, &(0x7f0000000240)=[@timestamping={{0x14, 0x1, 0x25, 0xaa9a}}, @mark={{0x14, 0x1, 0x24, 0x86}}, @txtime={{0x18, 0x1, 0x3d, 0x100000000}}, @timestamping={{0x14}}, @mark={{0x14, 0x1, 0x24, 0x1}}, @timestamping={{0x14, 0x1, 0x25, 0x38}}], 0x90}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="24c95064337c922c8c164da2d3ac1c93dc440b446ea96a429e967870bacdfa317054d2e68e378cd36370896a134615fb817e3ee1c9746f31ca97ad4f8a7c7ea806b5603df4e6412d9586489b60c9a0612d8d8694a965b437e9bae5292baa4f84444c38d895edf2f03c7ffa53d43bbf3e253e26cb4528b68dda1d4a06285c27ae8331185b9e8970d439aff19b61e2c8b669dcd596d47b63cd141b41f2f1a5b6e3c5ec87f43505cd0ec16c05938c9a08e87af6c264b10b2ca3fec32b2f4f454a225639343d7a7c42a39b0edd9e648e2f52bdc5f2e44d1c2b151de2ed1127379e15bd0867", 0xe3}, {&(0x7f0000000400)="2b55df4a0ebc042665f4198c7902a8212ef047ae1c8d9d04becf98ec5e3870bd9c5315d1e677218ca8c9a5a14a3b2513ff8ea328ef9365c6ad75cdab77a0b821f7d4274f29511515b7424ef646dbef4fd56f7b68b22c3e7e072d2d3e0af7281269058740ef17e2067df3a0fea3b401d6", 0x70}, {&(0x7f0000000480)="9d655d0ef05ccfd46889eba5008b91eadfe925bec05089f3c174a57f524d73dc3742009b7d7230c9887ec4bfa45994707bfa7e32afff8a24a25da6b9ed97b43bd2ccc92ae6ec7021d6a09bd5a3220f6f955662aa936c7ba1ad0bc5d013fb58fc3587e8", 0x63}, {&(0x7f0000000500)="f06224d1847875eae4a09b74f15bfb8f21f42b37dc8a1c357b00d98dd25a7d", 0x1f}, {&(0x7f0000000540)="3dd30a9230242dd2862a3cb1ea8d6b32fc722a51373b26656ab3f66015168225fd8b21fc69a607bdb55ecae975b89267f4dec2f8f0256507f1ab41d418c343ab7a7d946b091fbfea6a8cf290f11e1f6fe323b8ac1ef36e5a8f82f0ce144ddab9e06c1460bbcf9c1702611c36039cb5a768f14571ecb490127d290b041ceaa2bcf163d63093022ab5b03f380a2b833813df", 0x91}], 0x5, &(0x7f0000000680)=[@txtime={{0x18, 0x1, 0x3d, 0x5}}, @txtime={{0x18}}], 0x30}}], 0x2, 0x4004004) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket$nl_netfilter-sendmsg$IPCTNL_MSG_EXP_GET-writev-openat$cgroup_devices-write$cgroup_devices-socket$kcm detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000004100)={0x0, 0x0, &(0x7f00000040c0)={&(0x7f0000003f40)={0x38, 0x1, 0x2, 0x301, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @empty}}}]}]}, 0x38}}, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f30000000170a0017e9ffffff040037000900030001632564b7587ed2e7a6b9a64411f6bb744dc48f577c6ea6db125082897bbe546bab98f93551386ebb855ebd0104a1c57c555077d9e9a97cdda034ad1ea13696ea6497c3167f16809f3083e04fa419a65932e04a4c0c629c7c1e30dedc276d834e", 0x89}], 0x1) r2 = openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000100)={'b', ' *:* ', 'rw\x00'}, 0x9) socket$kcm(0x10, 0x2, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 1m40s testing program (duration=1m47s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 12, 21, 14, 24, 30, 15, 30, 26, 21, 4, 8, 16, 11, 5, 21, 10, 10, 1, 8, 16, 7, 2, 7, 19, 6, 3, 24, 5, 9] detailed listing: executing program 1: sendmsg$SMC_PNETID_FLUSH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x28, 0x0, 0x0, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'caif0\x00'}]}, 0x28}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x38, r1, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) getsockopt(r0, 0x1, 0x2, &(0x7f00000003c0)=""/165, &(0x7f0000000480)=0xa5) (async) getsockopt(r0, 0x1, 0x2, &(0x7f00000003c0)=""/165, &(0x7f0000000480)=0xa5) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000000)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000308", 0x38, 0x3a, 0x0, @private1, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "5b52ab", 0x0, 0x2b, 0x0, @private0, @private0, [@dstopts={0x88}]}}}}}}}, 0x0) (async) syz_emit_ethernet(0x6e, &(0x7f0000000000)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000308", 0x38, 0x3a, 0x0, @private1, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "5b52ab", 0x0, 0x2b, 0x0, @private0, @private0, [@dstopts={0x88}]}}}}}}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000010000004000018007000600666f00000800080000000000060001000200000008000500000000000c0007000000000000000000080009000000000008000b"], 0x54}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000001800dd8d000000eeff00000002000000000000070000000006001500040000001400168010000880060002800600010000000000"], 0x38}}, 0x0) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e24, 0x20000000, @rand_addr=' \x01\x00'}}, 0x0, 0x0, 0x3, 0x0, "ddfd3b7ed7c6a1c172a987ae5ce3cafd64c9a736831a5912d606798fb75c9981c4b3ac0e06891ff18bc5543ed57215a3c45f9154dfa319e52a15a2b9acf80c07fb1a854dad742eef6187f2304844c296"}, 0xd8) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b40000000000000061116c000000000017000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x4, 0x3e0, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x76, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000140)='mmap_lock_acquire_returned\x00', r4}, 0x10) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) recvmmsg(r5, &(0x7f00000066c0), 0x40000dc, 0x20010040, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x3c, r7, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_KEY={0x20, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee339084eeef16f162471f4"}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}]}]}, 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@newqdisc={0x78, 0x24, 0xf1d, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x2, 0xb5, 0x3, 0x8, 0x6}, 0x1, 0x1, 0xeb, 0x9, 0xd, 0x18, 0xc, 0xe, 0x1, 0x1000, {0x2800, 0x3, 0x0, 0x8, 0xef, 0x9}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x24, 0x2a, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0x3}}}, 0x24}}, 0x0) close(r0) executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000010000000c00050000000000000000000c0002000000000000000000040007800c00080000000000000000000800010000007fff"], 0x90}}, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000080)=@ethtool_ringparam={0x10, 0x0, 0xfffffffc, 0x0, 0x4, 0xf6c, 0x40000000, 0x0, 0xef3d}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r4, &(0x7f0000000300)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) listen(r4, 0xfdff) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000a40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x38, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_KEY={0x1c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "e59e75e84c"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac0d}]}]}, 0x38}}, 0x0) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x608, 0x0, 0x11, 0x148, 0x0, 0x10, 0x570, 0x2a8, 0x2a8, 0x570, 0x2a8, 0x7fffffe, 0x0, {[{{@uncond, 0x10, 0x2f8, 0x360, 0x1c, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x0, 0x9, 0x0, 0x0, 0xffffffff, 0x8}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x0, 0x6, './file0\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x19, 0x0, 0x0, 0x0, 'syz0\x00', 'syz1\x00'}}}, {{@ip={@multicast1, @rand_addr, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_batadv\x00'}, 0x0, 0x1c8, 0x210, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'team_slave_0\x00', {0x459, 0x0, 0x48, 0x0, 0x0, 0x3, 0x2}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@dev, 'macsec0\x00'}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x668) executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000002a00)=ANY=[@ANYBLOB="180200000000000000000000000000008500000018000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000027c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000002700)="e0b9547ed387dbe9abc86f5b7de8", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000004c0)={@cgroup, 0x12, 0x0, 0x80, &(0x7f0000000300)=[0x0], 0x1, 0x0, &(0x7f0000000340)=[0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000540)={0xffffffffffffffff}, 0x4) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000500)={@fallback=r0, r1, 0x24, 0x1c, 0x0, @void, @value=r3, @void, @void, r2}, 0x20) r4 = socket(0x23, 0x5, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) getsockopt$nfc_llcp(r4, 0x113, 0x0, 0x0, 0x692d84746b19a7c5) r7 = socket$packet(0x11, 0x3, 0x300) r8 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r8, 0x11, 0x67, &(0x7f0000000180)=0x7f, 0x4) connect$inet6(r8, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) write(r8, &(0x7f0000000200)="89ba41c97928dec7cec15a160d3dba257872aed129d4b5247c9834550448a4f46c37425b873ec95db3d757e8b2333a64d9abf416fd83f942661c47bcdf71f7d07ba2b2f051829a7f66952e57962614db0d03474a4a4bce636ea8d2b882b2b49ef18e76edbec7302a96e41f206d930eda2769c56e6d5e3d541ce9a21c3ce5cb5f", 0x80) setsockopt$packet_int(r7, 0x107, 0x8, &(0x7f0000000080)=0x4, 0x4) recvmmsg(r7, &(0x7f0000006580)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x98, r10, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@beacon=[@NL80211_ATTR_IE_ASSOC_RESP={0x0, 0x80, [@sec_chan_ofs={0x3e, 0x0, 0x2}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_TX_RATES={0x2c, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x8}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x0, 0x4, 0x2}]}]}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x98}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@bridge_newneigh={0x30, 0x1c, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x5e}, [@NDA_DST_IPV6={0x14, 0x1, @private2}]}, 0x30}}, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x11f, 0x0, 0x0, 0xfffff010}, {0x7, 0x0, 0x14}]}, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r4, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x2, 0x77}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0x34}, 0x1, 0x0, 0x0, 0x400040d1}, 0x488c0) executing program 4: syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) shutdown(r1, 0x1) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f00000007c0)="2681", 0x2}], 0x1}}], 0x1, 0x4048841) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x5, 0x0, 0x0, {}, {0x77359400}, {}, 0x2, @can={{}, 0x0, 0x3, 0x0, 0x0, "3fd31340e92c4bb8"}}, 0x48}, 0x300}, 0x0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000e4ff0000000000020202000900030073797a32000000000500040002000000090001"], 0x34}, 0x1, 0x40030000000000}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$sock_int(r5, 0x1, 0x2e, &(0x7f00000000c0)=0x101, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r5, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}], 0x1c) setsockopt(r5, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) recvmsg(r5, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000002c0)) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'team_slave_0\x00', 0x0}) r9 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000200)={'netdevsim0\x00', 0x0}) r11 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x14, '\x00', r10, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c00000010000100"/20, @ANYRES32=r8, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r11], 0x2c}}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000300)={0x0, @broadcast, @empty}, &(0x7f0000000340)=0xc) bpf$OBJ_GET_MAP(0x7, &(0x7f00000004c0)=@o_path={&(0x7f0000000480)='./file0\x00', 0x0, 0x10, r6}, 0x18) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, 0x0) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000280)={0x28, 0x0, 0xffffffff, @hyper}, 0x10) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f00000003c0)={@remote, 0x1c}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth1_to_bond\x00', &(0x7f00000006c0)=@ethtool_per_queue_op={0x4b, 0xe, [0x2, 0x5, 0x5, 0x0, 0x4, 0xb, 0x401, 0x7, 0x0, 0x0, 0x3, 0x8000, 0x3, 0x401, 0x5, 0x9, 0x5, 0x9, 0x9, 0x0, 0x7, 0x0, 0x3, 0xfffffff7, 0x0, 0xe, 0xe87, 0x10001, 0x1, 0x3, 0x0, 0x200, 0xc83, 0x1, 0xfffffffc, 0x6, 0xac79, 0x7, 0x6, 0x3, 0x4, 0xea, 0x0, 0x120000, 0x2, 0x6, 0x8, 0x2, 0x0, 0x7fff, 0x1, 0x1, 0xaf, 0x10000, 0xf42, 0x6, 0x81, 0xcd02, 0xb2df, 0x1, 0x6, 0x7, 0x5, 0x0, 0x2, 0x3, 0x400, 0x7fffffff, 0x6, 0x10000, 0x8, 0xdf, 0x10, 0x6a, 0x2, 0x6, 0x7, 0x40, 0x4adf, 0x7, 0x9, 0x9, 0x0, 0x4, 0x2, 0x8, 0x9, 0x6, 0x9, 0x8, 0xe, 0x1, 0xd, 0x0, 0x81e0, 0xf, 0x400, 0x4, 0x9, 0x2, 0x1, 0x3, 0x8, 0x4, 0x2, 0x6, 0xdaa, 0x5, 0xf9, 0x401, 0x1, 0x10001, 0x1, 0x1, 0x3f, 0x101, 0x4, 0x5da, 0xfff, 0x9, 0x7, 0x4, 0xee59, 0x4f65, 0x9, 0x9, 0x4267, 0x3], "b86ba95bff26a4ab277f85cebec2b98886ba70d6cdcf4dc9d4b783ce07a4f02e0d3a9f7819be11d953c2deca579d0ae75da58e634dd14874b358236d0db5204164940589475344d10610bb9b03daac10a2b44e5674c5063289af9d28011971b2cb38f1e237eaf70937d2"}}) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002"], 0x110) setsockopt$inet_group_source_req(r2, 0x0, 0x2c, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @broadcast}}, {{0x2, 0x0, @private=0xa010101}}}, 0x108) setsockopt$inet_group_source_req(r2, 0x0, 0x2b, &(0x7f0000000000)={0x5, {{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x4e20, @multicast1}}}, 0x108) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='freezer.self_freezing\x00', 0x0, 0x0) ioctl$PPPIOCCONNECT(r3, 0x4004743a, &(0x7f0000000240)=0x1) executing program 3: r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000000200)=[{{&(0x7f0000000040)={0x2, 0x0, @empty}, 0x10, 0x0}}, {{&(0x7f0000000000)={0x2, 0x0, @empty=0x3000000}, 0x10, 0x0}}], 0x2, 0x0) (async) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000008112a2000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$netlink(r1, 0x10e, 0xa, &(0x7f0000000000)=""/97, &(0x7f0000000140)=0x61) (async) r2 = socket$inet6(0xa, 0x2, 0x0) (async, rerun: 32) sendto$phonet(0xffffffffffffffff, &(0x7f0000000540)="30a9ccac9ba5d5443128c891c5cdb485c1cd57b9bda8e4a7c1eafc28d4d8e7e2ecc52872519fefe1c8f404d8a5a2a049e9d1a0c569fe0fe9c73d31994f6f9f9e80add86cf885f87ef81018466a3b7540cd34f9e960c8ab0f9281f689fcda4833f5f23274e9cdeb", 0x67, 0x60044014, &(0x7f0000000600)={0x23, 0xac, 0xb, 0x9}, 0x10) (rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x38, r4, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000280)={{{@in=@remote, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x0, 0x16}}, {{@in6=@empty, 0x0, 0x2b}, 0x0, @in6=@mcast2}}, 0xe8) (async, rerun: 32) r5 = socket$key(0xf, 0x3, 0x2) (rerun: 32) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f00000001c0), 0x4) (async) sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) (async) sendmsg$key(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) (async) r6 = socket$netlink(0x10, 0x3, 0x6) writev(r6, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23ffbf510040041feff5aff2b0000000000000700"/68, 0x44}, {&(0x7f0000000080)="c1130389", 0x4}], 0x2) (async, rerun: 64) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) (rerun: 64) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000900)=@newsa={0x184, 0x10, 0x1, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@local, 0x0, 0x0, 0x2000, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in=@multicast1, 0x0, 0x6c}, @in=@empty, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, {0x0, 0x4}, {}, 0x0, 0x0, 0x2, 0x1, 0x6}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @algo_aead={0x4c, 0x12, {{'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x0, 0x80}}]}, 0x184}}, 0x0) (async) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7b, 0x4) bind$inet(r8, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) (async) sendto$inet(r8, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) (async) setsockopt$sock_int(r8, 0x1, 0x8, &(0x7f0000000600), 0x4) (async) sendto$inet(r8, &(0x7f0000000700)="0c268a927f1f6588b967481241ba00600a34f65ac618ded8974897abeaf4b48344ab4ea6f7c555d88fecf90b037511bf746bec66ba", 0x35, 0x0, 0x0, 0x0) (async) recvmsg(r8, &(0x7f0000001500)={0x0, 0xa, &(0x7f0000002200)=[{&(0x7f00000035c0)=""/4106, 0x437aba2}], 0x1, 0x0, 0x46, 0x407006}, 0x104) setsockopt$inet_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f0000000380)='highspeed\x00', 0xa) executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket(0x22, 0x2, 0x3) getsockopt$packet_buf(r2, 0x107, 0x1, &(0x7f0000000240)=""/1, &(0x7f0000002180)=0x1) sendmsg$nl_xfrm(r1, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000a40)=ANY=[@ANYBLOB="6001000010000100000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb0000fff720000001000000003b000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="64010102000000000000000000000000000000006c000000ac1414bb00000000000000000000000000000000000000000000008000000000000000000000000000000000000000000300000000000000000000000000000004000000000000e3ff000000000000000000000000000000040000000000000000000040000000000000000000000000000000ba9b55090000000000fcffffff0000000002000001000000000000000008001f0004000000480003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000008001f0003000000150008"], 0x160}}, 0x4810) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = gettid() ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f00000000c0)=r4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xf, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000023762edd35eaff10dcf502ededdaf4fcf9c0277f25470a209eef60517864e9b22c641f47b842b055bc37f7bdec65f11f2d929f9fa31a5ae8ac8bf9ccb57e8e926d2ecf7402b101cedd0de2d07b76bdc76923af38bd00141ec22689f9302f41069e3340f20dc912eba8b3fa49afd0b2bb65600babf555505935938b4c44f13d790352fed3ccbc8ed27c9933b0514b1227efc915531996d87aee1bd0790700000000000000f450411ca55a3fda77190ab66f04e250b6b036dfde", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r6, 0x6, 0x3, &(0x7f0000000000)=0xc, 0x4) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0xa43, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r7 = accept4(r5, 0x0, 0x0, 0x0) sendmsg(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000380)="c130c435606b4e717ef9bcc0cb7cabc7029b4bc69e569bf13444be4593a12d83cff6cd2e2a767120cbf6405d5affc464e80d2abfa71bdad4d21a38e3294f60cc6bac3f725ae6b55723534dda54abf2254dc1e6aa96d263f5bde938c887292d36b72ec94b3934b96a8cec477adaaf6d4c3e437aa4d1251a15b5b5c1f3eae74bed98cf50aef2869f5360598077ea324263000beaa4e70f4f4f07511152439f397949270bb9ba6b276156e7fa81f0af3e1f0bad6305e8e122c1158b23fd46f0c5f3f2b8310b03b0ace1dd70307b226e432b2c8c819676d506c88522dcbee0266dacbf1bb481482a86be7b686d904e3858ff", 0xf0}], 0x1}, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x7) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r7) r8 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r8, 0x89fb, &(0x7f0000000940)={'sit0\x00', &(0x7f0000000900)={@private2, @empty, 0x10, 0xd}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000280)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018020000", @ANYRESDEC=r7, @ANYBLOB="0000000000000000660002000000000018000000ffffffd000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b00000008000000040000000400000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00 \x00'/28], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000040)={r0}, 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f00000004c0)) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r0, &(0x7f0000000340)="ac9198ef219f7c9fff52e82d1774e900e1fd6214179d4ff06dea2ddca0d4f6a1d2adf1ccb1f058a1eaa38172e0a6222914a7da242f104cacaa8c886e47cf1550660356b738b5bf32d0db2f77da5ec035c649b706ed53831fdd1448aae431f38ded71fa89a87a07e9f2d794668662ca8326358b15fdc376f8abc33b2b413f0cf6f6deb51601a51265b0ec85cc9c6747d29e7f51d8c7c52074eba2a6ddb6584dba878e8baa8b67fafbbbfa6119f75e3f", &(0x7f0000000400)=""/146}, 0x20) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f00000001c0)={'veth1_virt_wifi\x00', @local}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket(0x8, 0x2, 0xc) getsockname$packet(r4, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0xb, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x88eadb6ac961f7c6}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r6, &(0x7f0000002c00)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000002680)="d7", 0xfffffff9}], 0x1, &(0x7f0000003280)=ANY=[], 0x550}, 0x0) sendmmsg(r6, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x240028c1) socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000080)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="2bfafdffffff000000b30700000008002300", @ANYRES32=r8, @ANYBLOB="0800050007000000140004006e696376663000"/28], 0x38}}, 0x0) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), r0) sendmsg$IEEE802154_LLSEC_LIST_DEV(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r1, 0x321}, 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000000079108700000000001e000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) executing program 2: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000cc0)=@delchain={0x198, 0x65, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x4, 0x9}, {0x0, 0xb}}, [@TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @TCA_CHAIN={0x8}, @filter_kind_options=@f_route={{0xa}, {0x150, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0xffff, 0xd}}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0x134, 0x6, [@m_nat={0x84, 0x20, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @rand_addr, @loopback}}]}, {0x31, 0x6, "3eaed48f5023f5c36bc9d8619f3e2af20800000000000000a40bc384135c74eb813bf1cf69dbeaddd76b564e92"}, {0xc}, {0xc}}}, @m_connmark={0x40, 0x0, 0x0, 0x0, {{0xd}, {0x4}, {0xd, 0x6, "66396e732cf67237ec"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_bpf={0x6c, 0x0, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6}]}, {0x3b, 0x6, "ca8fd735f4c425bd44291fa86781920ab90ff95c64e3d33704248d0546950f6c3113358c2551981c52f5a6dd8a3891697d8ab8d8f56d15"}, {0xc}, {0xc}}}]}]}}]}, 0x198}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@gettclass={0x24, 0x2a, 0x10, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xc, 0xa}, {0x10, 0xc}, {0x1, 0xb}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a0b0400000000000000000200000048000480440001800c0001007061796c6f616400340002800800054000000000080002400000000008000440000000000800034000000000080008400400000008000740000000000900010073797a30000000000900020073797a32"], 0x9c}}, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc000000850000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc000000850000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = socket(0x10, 0x3, 0x0) connect$netlink(r1, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x1}, 0xc) r2 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) (async) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000020c0)=@newqdisc={0x58, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7, 0x80, 0x0, 0x1000, 0x2, 0x7fffffff, 0x10088}}, {0x4}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x8800}, 0x0) connect$packet(r1, &(0x7f0000000180)={0x11, 0x1a, r4, 0x1, 0xf, 0x6, @broadcast}, 0x14) (async) connect$packet(r1, &(0x7f0000000180)={0x11, 0x1a, r4, 0x1, 0xf, 0x6, @broadcast}, 0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2300, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x2c, 0x1d, 0xa, 0x805, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0x74}}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) executing program 2: setsockopt(0xffffffffffffffff, 0x84, 0x81, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x1c0, 0xc8, 0x8, 0x0, 0x5803, 0x320, 0x2e8, 0x2e8, 0x320, 0x2e8, 0x3, 0x0, {[{{@ipv6={@remote, @empty, [], [], 'vlan0\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1c0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1, 0x6}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@ipv6header={{0x28}}, @common=@eui64={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x2, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r2) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac1414aa00000000000000001400020002000000e000000200000000000004000d0001007564703a73"], 0x54}}, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "000005", 0x14, 0x6, 0x0, @private0, @mcast1={0xff, 0x10}, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000080)) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r1, @ANYBLOB="db1d88550ca4406693d6b64e9ec37be08d3159073be620db49c84bad3d96755c115d573ca22ae33db16a94afca6ac6516453070913106c4006cfc85ebe1224712df4de6c38a068580a0679879631978a7ad6ccd76147185d50367e551eabc1fe7142401543fd2e7e4f88bcfa946d1b4f48790efd4119da38e772b4d8464470fcd9878d2c3265cd0b5a0d57ed08bfd8f6435ef247341f1ed1368acc9acc97e76a98ccbb711546"], 0x38}}, 0x0) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r1) (async) r2 = socket$unix(0x1, 0x2, 0x0) connect$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000340), 0x4) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000440)=0x82, 0x49) (async) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) (async) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x3f) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x1000001, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x4, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000dd0a0000000000006301410000000000950000004d000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x300, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r4 = openat$cgroup_devices(r3, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB='c 122', @ANYRESHEX], 0xa) (async) r5 = socket$l2tp6(0xa, 0x2, 0x73) sendto$l2tp6(r5, 0x0, 0x0, 0x4008814, &(0x7f0000000100)={0xa, 0x0, 0x8, @private1}, 0x20) sendto$inet(r0, &(0x7f0000000480)="fbbf0b5044e308cb7bd572aa2b42e9678bcf30eff9f3aed14dc94a114bd2b45956aebe2b108a87e865501a5f9e0383611afdd3f8bac3d5cfd7772a3ab48d0ba4b600731e357e38716c449fae7c28548a4f2105f44b8fd9b33041270ae01f1a405e3f650fc3b0926d481c364fca00000000000000006d3a3ede9fc738b8d86209c060161d5ddb5fcf3d09001117cdb9d055aa2d89fe3458720724853a876448d4a1fe9ef0569ad98a05ab5df763923b4e2c576e00000000000000000000000000000000002090666159e3075f7244cf4ec3d7814c0c934f44e200219e6dd7bc23397d5f2f2c76a5baddd0fd8c340362691ef226f7a0ac51b74b6be5ed6737948514cd466943d08eeb3895b80499da2b209da4f3ec5e3744ce3e863b0e04d0ec2f39edf50b6e08c4b47e448a35414763d687fbe3792ee15c5b9791310a346472723c100bf77a310b0ced8004b5ac6d48c40439f512e8ef34a53d65f55563f68136a577736ca5f6f66e01ef4ec2cdc8db34f6de50713adaa3f70189958263fddc1314f8a28ccdef6e1390c5fbaeadc3035d019f0dc75de307de6c0d010000000000000027083d1d5b4b013c503b863b560688d94de886b6dc73d5da2dfeff4bed1a49a975a6c8dbb480e4415ddca5657a5a8e3b111015499e952bb5e8d8f60de3d688df7802c6e8b27b31fac4e199038b79a3999920e634a5af162a9581b0e6647e410700246548234acacf9cb43ab332a37bbc926c39897395c974fda31536be523bf4260300730ae6136fecae5f0fa6ab2df8d98128b24589e3bbe5230e07dc5e0d65cc397e3f8204d48e59e8e294a6d7008ba8fba28cd5009fe1a7c569ce740078bf1c7389a6ba0f89257f0eac417aac0d2d89b05ee5dafa2f1d936c87264d077b2c0d5abdbc64ce943f895dd4c2e9dd7393543d89b00dc6b3a25045d4ec932366c67dfad087fa8dc104644828440bdf67dd97ebccb3bd", 0xfffffea5, 0xc000, 0x0, 0xfffffcef) (async) recvmsg(r0, &(0x7f00000033c0)={&(0x7f00000003c0)=@ethernet={0x0, @dev}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000080)=""/46, 0x31}, {&(0x7f00000021c0)=""/4087, 0x1000}, {&(0x7f0000000f80)=""/4096, 0xfffffffffffffe12}, {&(0x7f0000000280)=""/102, 0x66}], 0x4, &(0x7f0000001f80)=""/178, 0xb2}, 0x10120) (async) sendmsg$unix(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000140)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000800), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r0, @ANYBLOB="000000004540ad18a4661c2f407b9c4fcebad02fb2c7d2e50aac244f79a9a13b0fbc5ad117f44b643feb63a8221b083ca83b4e54552af30275f13b19b99e403ec58429d977d953d0ceaaa161bca3904e7640ab8316e4c00e71d3669857db2c968be3418d5a645f490997bbfbcb9d47a399ef4653f889741c006c1a76f257257913699156ef44a988083cac80cf5c249f8c8852bc42024de815ab3e"], 0x28, 0x4}, 0x48900) executing program 0: r0 = socket(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x10000000, 0x1, 0x7}}]}}]}, 0x44}}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000240)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000280)={r4, 0x11, 0x6, @local}, 0x10) (async) close(r3) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@getaddr={0x14, 0x16, 0x10, 0x70bd25, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x48001) executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="3b000000010006", 0x7) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x2, 0x2, 0x0, 0x3, 0x11, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}, @sadb_x_sa2={0x2, 0x9}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @sadb_x_sec_ctx={0x1, 0x18, 0x4}]}, 0x88}}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) (async) write(r0, &(0x7f0000000000)="3b000000010006", 0x7) (async) socket$key(0xf, 0x3, 0x2) (async) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x2, 0x2, 0x0, 0x3, 0x11, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}, @sadb_x_sa2={0x2, 0x9}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @sadb_x_sec_ctx={0x1, 0x18, 0x4}]}, 0x88}}, 0x0) (async) executing program 3: bind$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4a23}, 0xffffff52) executing program 0: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r1, &(0x7f0000000180)="c2", 0x1, 0x24004400, &(0x7f0000000000)={0xa, 0x2, 0x0, @loopback}, 0x1c) shutdown(r1, 0x1) sendmmsg$inet6(r1, &(0x7f0000001040)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001700)='\x00', 0x1}], 0x1}}], 0x1, 0x80) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x60, r0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x2c, 0x51, 0x0, 0x1, [{0x80, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "02d0e86cbe4d68f75ce39f0dab"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac09}, @NL80211_KEY_IDX={0x5}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x60}}, 0x0) executing program 4: r0 = socket(0x2, 0x3, 0xff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan0\x00', 0x0}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @broadcast}, 0x10) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000200)={r1, 0x3, 0x6}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x30, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x30}}, 0x0) socket(0x2, 0x3, 0xff) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan0\x00'}) (async) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @broadcast}, 0x10) (async) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000200)={r1, 0x3, 0x6}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x30, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x30}}, 0x0) (async) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000004100)={0x0, 0x0, &(0x7f00000040c0)={&(0x7f0000003f40)={0x38, 0x1, 0x2, 0x301, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @empty}}}]}]}, 0x38}}, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f30000000170a0017e9ffffff040037000900030001632564b7587ed2e7a6b9a64411f6bb744dc48f577c6ea6db125082897bbe546bab98f93551386ebb855ebd0104a1c57c555077d9e9a97cdda034ad1ea13696ea6497c3167f16809f3083e04fa419a65932e04a4c0c629c7c1e30dedc276d834e", 0x89}], 0x1) r2 = openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000100)={'b', ' *:* ', 'rw\x00'}, 0x9) socket$kcm(0x10, 0x2, 0x0) executing program 4: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)={0x108, 0x2c, 0x1, 0x0, 0x0, "", [@generic="d447ec83996c742d2879d6f82b672953c4d108d89a0a34d1da826756b314505a6de4c35c903500ea24092f972070b9b26899ae6ccbe3540e575a9a0043356abcd457456d69b5a8652d0a23b9ff427b2a59351cc877562f7bafa5a29b0ff9de83e051b6512bdd460ffd7f93c4af3b1bc164fe4350d9bc7d38983b56664980540c9e70557bde18a53cb4ebc30ad451f7b0845448441a2fb9b551358a535349101f9ff708cc3c8da103302f23fbcdc66535a3354b5ab32f63b520ad7b03bfe1167c4a037ca59942b8cb7a39005557cbd86f17e5be6f3d6863eb4a15c530581c44fc790cd85fe06f46c7b71e56eae90da5fae7398f9a", @nested={0x4, 0x19}]}, 0x108}], 0x1}, 0x0) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x65, &(0x7f00000019c0)=0x1, 0x4) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f0000000000), 0x8) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0xe20, 0x0, @local}, 0x1c) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x40d, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x680de}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}]}, 0x34}}, 0x0) executing program 2: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000022c0)='`', 0x1}], 0x1}}, {{&(0x7f0000000900)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, &(0x7f0000003580)=[{&(0x7f0000000940)='z', 0x1}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x1, &(0x7f0000001280)=""/4097, &(0x7f00000000c0)=0x1001) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r3, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r1}, 0x20) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0x18, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x3, 0x12}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}]}, 0x58}}, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000a00)=""/157, 0x9d}], 0x1}}], 0x1, 0x2, 0x0) r5 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4c, 0x2, [@TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_HH_FLOWS_LIMIT={0x8}, @TCA_HHF_NON_HH_WEIGHT={0x8}, @TCA_HHF_EVICT_TIMEOUT={0xfffffffffffffebc}, @TCA_HHF_RESET_TIMEOUT, @TCA_HHF_ADMIT_BYTES={0x8}, @TCA_HHF_EVICT_TIMEOUT={0x8}, @TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_ADMIT_BYTES={0x8}]}}]}, 0x78}}, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000080), 0x4) sendmmsg$sock(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="37718a623f9df45f31dee3a1dc342c86a363751e2b8d5e4f0d4366991cd78e840aa76b6cc4c63fcea7aba2813a20b7a2c7c4bee81f3edbddf68bed731be31afb85e879aadbc214c3dfb7fc9cb0c52bac4ad7d2d4fda74ca2b8385c3e7ef5bb18296e3e7f0e17aee30701bc68474f9fc355cd1d3f69c24a24cbfa0f8b69e8a311ef1d31e4fea8fac084d8cd6eafae5cd7b3d4985cf163bf8067c8b3dbda5a5df6369be1d5db4a30e4", 0xa8}, {&(0x7f0000000040)}, {&(0x7f00000001c0)="fc8c", 0x2}], 0x3, &(0x7f0000000240)=[@timestamping={{0x14, 0x1, 0x25, 0xaa9a}}, @mark={{0x14, 0x1, 0x24, 0x86}}, @txtime={{0x18, 0x1, 0x3d, 0x100000000}}, @timestamping={{0x14}}, @mark={{0x14, 0x1, 0x24, 0x1}}, @timestamping={{0x14, 0x1, 0x25, 0x38}}], 0x90}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="24c95064337c922c8c164da2d3ac1c93dc440b446ea96a429e967870bacdfa317054d2e68e378cd36370896a134615fb817e3ee1c9746f31ca97ad4f8a7c7ea806b5603df4e6412d9586489b60c9a0612d8d8694a965b437e9bae5292baa4f84444c38d895edf2f03c7ffa53d43bbf3e253e26cb4528b68dda1d4a06285c27ae8331185b9e8970d439aff19b61e2c8b669dcd596d47b63cd141b41f2f1a5b6e3c5ec87f43505cd0ec16c05938c9a08e87af6c264b10b2ca3fec32b2f4f454a225639343d7a7c42a39b0edd9e648e2f52bdc5f2e44d1c2b151de2ed1127379e15bd0867", 0xe3}, {&(0x7f0000000400)="2b55df4a0ebc042665f4198c7902a8212ef047ae1c8d9d04becf98ec5e3870bd9c5315d1e677218ca8c9a5a14a3b2513ff8ea328ef9365c6ad75cdab77a0b821f7d4274f29511515b7424ef646dbef4fd56f7b68b22c3e7e072d2d3e0af7281269058740ef17e2067df3a0fea3b401d6", 0x70}, {&(0x7f0000000480)="9d655d0ef05ccfd46889eba5008b91eadfe925bec05089f3c174a57f524d73dc3742009b7d7230c9887ec4bfa45994707bfa7e32afff8a24a25da6b9ed97b43bd2ccc92ae6ec7021d6a09bd5a3220f6f955662aa936c7ba1ad0bc5d013fb58fc3587e8", 0x63}, {&(0x7f0000000500)="f06224d1847875eae4a09b74f15bfb8f21f42b37dc8a1c357b00d98dd25a7d", 0x1f}, {&(0x7f0000000540)="3dd30a9230242dd2862a3cb1ea8d6b32fc722a51373b26656ab3f66015168225fd8b21fc69a607bdb55ecae975b89267f4dec2f8f0256507f1ab41d418c343ab7a7d946b091fbfea6a8cf290f11e1f6fe323b8ac1ef36e5a8f82f0ce144ddab9e06c1460bbcf9c1702611c36039cb5a768f14571ecb490127d290b041ceaa2bcf163d63093022ab5b03f380a2b833813df", 0x91}], 0x5, &(0x7f0000000680)=[@txtime={{0x18, 0x1, 0x3d, 0x5}}, @txtime={{0x18}}], 0x30}}], 0x2, 0x4004004) executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updsa={0x104, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private0, @in=@multicast2}, {@in6=@local, 0x1, 0x3c}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in6=@dev}]}, 0x104}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program did not crash replaying the whole log did not cause a kernel crash single: executing 5 programs separately with timeout 6m0s testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS-sendmsg$RDMA_NLDEV_CMD_STAT_SET-bind$inet6-sendto$inet6-setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS-mmap-syz_genetlink_get_family_id$netlbl_unlabel-recvfrom$inet6 detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-socket$inet_udplite-setsockopt$EBT_SO_SET_ENTRIES-ioctl$HCIINQUIRY-bind$bt_hci detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-ioctl$sock_SIOCOUTQNSD-bpf$BPF_PROG_WITH_BTFID_LOAD-socket$nl_route-socket$nl_generic-ioctl$ifreq_SIOCGIFINDEX_batadv_mesh-socket$nl_route-openat$tun-ioctl$TUNSETIFF-bpf$PROG_LOAD-socket$packet-socket$kcm-ioctl$SIOCSIFHWADDR-write$tun-sendmsg-sendmsg$kcm-sendmsg$kcm-syz_init_net_socket$bt_hidp-write$cgroup_subtree-socket$kcm-sendmsg$NFT_BATCH-write$cgroup_subtree detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$inet6_sctp-sendmmsg$inet6-shutdown-getsockopt$bt_hci-socket$inet6_tcp-listen-bpf$PROG_LOAD-bpf$MAP_CREATE-bpf$BPF_PROG_DETACH-bpf$MAP_UPDATE_ELEM-socket$key-sendmsg$key-recvmmsg-socket-ioctl$ifreq_SIOCGIFINDEX_team-socket$netlink-sendmsg$nl_route_sched-setsockopt$inet6_tcp_int-sendmmsg$sock detailed listing: executing program 0: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000022c0)='`', 0x1}], 0x1}}, {{&(0x7f0000000900)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, &(0x7f0000003580)=[{&(0x7f0000000940)='z', 0x1}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x1, &(0x7f0000001280)=""/4097, &(0x7f00000000c0)=0x1001) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r3, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r1}, 0x20) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0x18, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x3, 0x12}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}]}, 0x58}}, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000a00)=""/157, 0x9d}], 0x1}}], 0x1, 0x2, 0x0) r5 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4c, 0x2, [@TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_HH_FLOWS_LIMIT={0x8}, @TCA_HHF_NON_HH_WEIGHT={0x8}, @TCA_HHF_EVICT_TIMEOUT={0xfffffffffffffebc}, @TCA_HHF_RESET_TIMEOUT, @TCA_HHF_ADMIT_BYTES={0x8}, @TCA_HHF_EVICT_TIMEOUT={0x8}, @TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_ADMIT_BYTES={0x8}]}}]}, 0x78}}, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000080), 0x4) sendmmsg$sock(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="37718a623f9df45f31dee3a1dc342c86a363751e2b8d5e4f0d4366991cd78e840aa76b6cc4c63fcea7aba2813a20b7a2c7c4bee81f3edbddf68bed731be31afb85e879aadbc214c3dfb7fc9cb0c52bac4ad7d2d4fda74ca2b8385c3e7ef5bb18296e3e7f0e17aee30701bc68474f9fc355cd1d3f69c24a24cbfa0f8b69e8a311ef1d31e4fea8fac084d8cd6eafae5cd7b3d4985cf163bf8067c8b3dbda5a5df6369be1d5db4a30e4", 0xa8}, {&(0x7f0000000040)}, {&(0x7f00000001c0)="fc8c", 0x2}], 0x3, &(0x7f0000000240)=[@timestamping={{0x14, 0x1, 0x25, 0xaa9a}}, @mark={{0x14, 0x1, 0x24, 0x86}}, @txtime={{0x18, 0x1, 0x3d, 0x100000000}}, @timestamping={{0x14}}, @mark={{0x14, 0x1, 0x24, 0x1}}, @timestamping={{0x14, 0x1, 0x25, 0x38}}], 0x90}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="24c95064337c922c8c164da2d3ac1c93dc440b446ea96a429e967870bacdfa317054d2e68e378cd36370896a134615fb817e3ee1c9746f31ca97ad4f8a7c7ea806b5603df4e6412d9586489b60c9a0612d8d8694a965b437e9bae5292baa4f84444c38d895edf2f03c7ffa53d43bbf3e253e26cb4528b68dda1d4a06285c27ae8331185b9e8970d439aff19b61e2c8b669dcd596d47b63cd141b41f2f1a5b6e3c5ec87f43505cd0ec16c05938c9a08e87af6c264b10b2ca3fec32b2f4f454a225639343d7a7c42a39b0edd9e648e2f52bdc5f2e44d1c2b151de2ed1127379e15bd0867", 0xe3}, {&(0x7f0000000400)="2b55df4a0ebc042665f4198c7902a8212ef047ae1c8d9d04becf98ec5e3870bd9c5315d1e677218ca8c9a5a14a3b2513ff8ea328ef9365c6ad75cdab77a0b821f7d4274f29511515b7424ef646dbef4fd56f7b68b22c3e7e072d2d3e0af7281269058740ef17e2067df3a0fea3b401d6", 0x70}, {&(0x7f0000000480)="9d655d0ef05ccfd46889eba5008b91eadfe925bec05089f3c174a57f524d73dc3742009b7d7230c9887ec4bfa45994707bfa7e32afff8a24a25da6b9ed97b43bd2ccc92ae6ec7021d6a09bd5a3220f6f955662aa936c7ba1ad0bc5d013fb58fc3587e8", 0x63}, {&(0x7f0000000500)="f06224d1847875eae4a09b74f15bfb8f21f42b37dc8a1c357b00d98dd25a7d", 0x1f}, {&(0x7f0000000540)="3dd30a9230242dd2862a3cb1ea8d6b32fc722a51373b26656ab3f66015168225fd8b21fc69a607bdb55ecae975b89267f4dec2f8f0256507f1ab41d418c343ab7a7d946b091fbfea6a8cf290f11e1f6fe323b8ac1ef36e5a8f82f0ce144ddab9e06c1460bbcf9c1702611c36039cb5a768f14571ecb490127d290b041ceaa2bcf163d63093022ab5b03f380a2b833813df", 0x91}], 0x5, &(0x7f0000000680)=[@txtime={{0x18, 0x1, 0x3d, 0x5}}, @txtime={{0x18}}], 0x30}}], 0x2, 0x4004004) program did not crash testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$netlink-socket$nl_netfilter-sendmsg$IPCTNL_MSG_EXP_GET-writev-openat$cgroup_devices-write$cgroup_devices-socket$kcm detailed listing: executing program 0: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000004100)={0x0, 0x0, &(0x7f00000040c0)={&(0x7f0000003f40)={0x38, 0x1, 0x2, 0x301, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @empty}}}]}]}, 0x38}}, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f30000000170a0017e9ffffff040037000900030001632564b7587ed2e7a6b9a64411f6bb744dc48f577c6ea6db125082897bbe546bab98f93551386ebb855ebd0104a1c57c555077d9e9a97cdda034ad1ea13696ea6497c3167f16809f3083e04fa419a65932e04a4c0c629c7c1e30dedc276d834e", 0x89}], 0x1) r2 = openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000100)={'b', ' *:* ', 'rw\x00'}, 0x9) socket$kcm(0x10, 0x2, 0x0) program did not crash single: failed to extract reproducer bisect: bisecting 30 programs with base timeout 6m0s testing program (duration=6m7s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 12, 21, 14, 24, 30, 15, 30, 26, 21, 4, 8, 16, 11, 5, 21, 10, 10, 1, 8, 16, 7, 2, 7, 19, 6, 3, 24, 5, 9] detailed listing: executing program 1: sendmsg$SMC_PNETID_FLUSH(0xffffffffffffffff, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)={0x28, 0x0, 0x0, 0x0, 0x0, {}, [@SMC_PNETID_ETHNAME={0x14, 0x2, 'caif0\x00'}]}, 0x28}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r0, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x38, r1, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) executing program 1: r0 = socket$packet(0x11, 0x2, 0x300) getsockopt(r0, 0x1, 0x2, &(0x7f00000003c0)=""/165, &(0x7f0000000480)=0xa5) (async) getsockopt(r0, 0x1, 0x2, &(0x7f00000003c0)=""/165, &(0x7f0000000480)=0xa5) r1 = socket$nl_route(0x10, 0x3, 0x0) syz_emit_ethernet(0x6e, &(0x7f0000000000)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000308", 0x38, 0x3a, 0x0, @private1, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "5b52ab", 0x0, 0x2b, 0x0, @private0, @private0, [@dstopts={0x88}]}}}}}}}, 0x0) (async) syz_emit_ethernet(0x6e, &(0x7f0000000000)={@broadcast, @link_local, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, "000308", 0x38, 0x3a, 0x0, @private1, @local, {[], @pkt_toobig={0x2, 0x0, 0x0, 0x0, {0x0, 0x6, "5b52ab", 0x0, 0x2b, 0x0, @private0, @private0, [@dstopts={0x88}]}}}}}}}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$F2FS_IOC_WRITE_CHECKPOINT(r0, 0xf507, 0x0) syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$ipvs(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$IPVS_CMD_NEW_SERVICE(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01000000000000000000010000004000018007000600666f00000800080000000000060001000200000008000500000000000c0007000000000000000000080009000000000008000b"], 0x54}}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="380000001800dd8d000000eeff00000002000000000000070000000006001500040000001400168010000880060002800600010000000000"], 0x38}}, 0x0) executing program 4: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r0, 0x6, 0xe, &(0x7f0000000100)={@in6={{0xa, 0x4e24, 0x20000000, @rand_addr=' \x01\x00'}}, 0x0, 0x0, 0x3, 0x0, "ddfd3b7ed7c6a1c172a987ae5ce3cafd64c9a736831a5912d606798fb75c9981c4b3ac0e06891ff18bc5543ed57215a3c45f9154dfa319e52a15a2b9acf80c07fb1a854dad742eef6187f2304844c296"}, 0xd8) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket(0x10, 0x3, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x8, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB="b40000000000000061116c000000000017000000000000009500000000000000"], &(0x7f0000000080)='GPL\x00', 0x4, 0x3e0, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x76, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000140)='mmap_lock_acquire_returned\x00', r4}, 0x10) r5 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r5, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) recvmmsg(r5, &(0x7f00000066c0), 0x40000dc, 0x20010040, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r3, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYRES32=r6, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r8, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x3c, r7, 0x801, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_KEY={0x20, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee339084eeef16f162471f4"}, @NL80211_KEY_TYPE={0x8, 0x7, 0x2}]}]}, 0x3c}}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000180)=@newqdisc={0x78, 0x24, 0xf1d, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x2, 0xb5, 0x3, 0x8, 0x6}, 0x1, 0x1, 0xeb, 0x9, 0xd, 0x18, 0xc, 0xe, 0x1, 0x1000, {0x2800, 0x3, 0x0, 0x8, 0xef, 0x9}}}}]}, 0x78}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x24, 0x2a, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {}, {0x3}}}, 0x24}}, 0x0) close(r0) executing program 1: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYBLOB="90000000", @ANYRES16=r1, @ANYBLOB="01000000000000000000010000000c00050000000000000000000c0002000000000000000000040007800c00080000000000000000000800010000007fff"], 0x90}}, 0x0) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f0000000000)={'netdevsim0\x00', &(0x7f0000000080)=@ethtool_ringparam={0x10, 0x0, 0xfffffffc, 0x0, 0x4, 0xf6c, 0x40000000, 0x0, 0xef3d}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) connect$netrom(r4, &(0x7f0000000300)={{0x6, @rose}, [@remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}]}, 0x48) listen(r4, 0xfdff) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000a40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000100)={0x38, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_KEY={0x1c, 0x50, 0x0, 0x1, [@NL80211_KEY_DEFAULT_MGMT={0x4}, @NL80211_KEY_DATA_WEP40={0x9, 0x1, "e59e75e84c"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac0d}]}]}, 0x38}}, 0x0) r7 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r7, 0x0, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x608, 0x0, 0x11, 0x148, 0x0, 0x10, 0x570, 0x2a8, 0x2a8, 0x570, 0x2a8, 0x7fffffe, 0x0, {[{{@uncond, 0x10, 0x2f8, 0x360, 0x1c, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip6gretap0\x00', {0x0, 0x0, 0x9, 0x0, 0x0, 0xffffffff, 0x8}}}, @common=@unspec=@bpf1={{0x230, 'bpf\x00', 0x0}, @pinned={0x1, 0x0, 0x6, './file0\x00'}}]}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x19, 0x0, 0x0, 0x0, 'syz0\x00', 'syz1\x00'}}}, {{@ip={@multicast1, @rand_addr, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_batadv\x00'}, 0x0, 0x1c8, 0x210, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'team_slave_0\x00', {0x459, 0x0, 0x48, 0x0, 0x0, 0x3, 0x2}}}]}, @common=@inet=@TEE={0x48, 'TEE\x00', 0x1, {@ipv6=@dev, 'macsec0\x00'}}}], {{'\x00', 0xc8, 0x70, 0x98}, {0x28}}}}, 0x668) executing program 4: socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xc, &(0x7f0000002a00)=ANY=[@ANYBLOB="180200000000000000000000000000008500000018000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007100000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000027c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000002700)="e0b9547ed387dbe9abc86f5b7de8", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) bpf$BPF_PROG_QUERY(0x10, &(0x7f00000004c0)={@cgroup, 0x12, 0x0, 0x80, &(0x7f0000000300)=[0x0], 0x1, 0x0, &(0x7f0000000340)=[0x0, 0x0], &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000480)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0}, 0x40) r3 = bpf$BPF_PROG_GET_FD_BY_ID(0xd, &(0x7f0000000540)={0xffffffffffffffff}, 0x4) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000500)={@fallback=r0, r1, 0x24, 0x1c, 0x0, @void, @value=r3, @void, @void, r2}, 0x20) r4 = socket(0x23, 0x5, 0x0) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r4) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) getsockopt$nfc_llcp(r4, 0x113, 0x0, 0x0, 0x692d84746b19a7c5) r7 = socket$packet(0x11, 0x3, 0x300) r8 = socket$inet6(0xa, 0x800000000000002, 0x0) setsockopt$inet6_udp_int(r8, 0x11, 0x67, &(0x7f0000000180)=0x7f, 0x4) connect$inet6(r8, &(0x7f0000000080)={0xa, 0x0, 0x0, @mcast2, 0x2}, 0x1c) write(r8, &(0x7f0000000200)="89ba41c97928dec7cec15a160d3dba257872aed129d4b5247c9834550448a4f46c37425b873ec95db3d757e8b2333a64d9abf416fd83f942661c47bcdf71f7d07ba2b2f051829a7f66952e57962614db0d03474a4a4bce636ea8d2b882b2b49ef18e76edbec7302a96e41f206d930eda2769c56e6d5e3d541ce9a21c3ce5cb5f", 0x80) setsockopt$packet_int(r7, 0x107, 0x8, &(0x7f0000000080)=0x4, 0x4) recvmmsg(r7, &(0x7f0000006580)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r9, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r9, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)={0x98, r10, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r11}, @void}}, [@beacon=[@NL80211_ATTR_IE_ASSOC_RESP={0x0, 0x80, [@sec_chan_ofs={0x3e, 0x0, 0x2}]}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_TX_RATES={0x2c, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x8}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x0, 0x4, 0x2}]}]}, @NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_EXTERNAL_AUTH_SUPPORT={0x4}]}, 0x98}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)=@bridge_newneigh={0x30, 0x1c, 0x1, 0x0, 0x0, {0xa, 0x0, 0x0, 0x0, 0x0, 0x5e}, [@NDA_DST_IPV6={0x14, 0x1, @private2}]}, 0x30}}, 0x0) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000040)=[{0x11f, 0x0, 0x0, 0xfffff010}, {0x7, 0x0, 0x14}]}, 0x10) sendmsg$NL80211_CMD_SET_PMKSA(r4, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x34, r5, 0x2, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r6}, @val={0xc, 0x99, {0x2, 0x77}}}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}]}, 0x34}, 0x1, 0x0, 0x0, 0x400040d1}, 0x488c0) executing program 4: syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r1, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0xfff0) setsockopt$inet_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) connect$inet(r1, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) shutdown(r1, 0x1) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000140)=[{{0x0, 0x0, &(0x7f0000000ec0)=[{&(0x7f00000007c0)="2681", 0x2}], 0x1}}], 0x1, 0x4048841) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000000c0)={0x5, 0x0, 0x0, {}, {0x77359400}, {}, 0x2, @can={{}, 0x0, 0x3, 0x0, 0x0, "3fd31340e92c4bb8"}}, 0x48}, 0x300}, 0x0) r4 = syz_genetlink_get_family_id$smc(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$SMC_PNETID_DEL(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010000e4ff0000000000020202000900030073797a32000000000500040002000000090001"], 0x34}, 0x1, 0x40030000000000}, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$sock_int(r5, 0x1, 0x2e, &(0x7f00000000c0)=0x101, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX_OLD(r5, 0x84, 0x6b, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, 0x8}], 0x1c) setsockopt(r5, 0x84, 0x7f, &(0x7f0000000040)="020000000980ffff", 0x8) recvmsg(r5, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f00000002c0)) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'team_slave_0\x00', 0x0}) r9 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000200)={'netdevsim0\x00', 0x0}) r11 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x14, '\x00', r10, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="2c00000010000100"/20, @ANYRES32=r8, @ANYBLOB="00000000000000000c002b8008000100", @ANYRES32=r11], 0x2c}}, 0x0) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000300)={0x0, @broadcast, @empty}, &(0x7f0000000340)=0xc) bpf$OBJ_GET_MAP(0x7, &(0x7f00000004c0)=@o_path={&(0x7f0000000480)='./file0\x00', 0x0, 0x10, r6}, 0x18) executing program 2: r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$TUNSETFILTEREBPF(r1, 0x800454e1, 0x0) bind$vsock_stream(0xffffffffffffffff, &(0x7f0000000280)={0x28, 0x0, 0xffffffff, @hyper}, 0x10) socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f00000003c0)={@remote, 0x1c}) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r2, 0x0, 0x2a, &(0x7f0000000180)={0x2, {{0x2, 0x0, @multicast2}}}, 0x88) ioctl$sock_SIOCETHTOOL(r2, 0x8946, &(0x7f00000002c0)={'veth1_to_bond\x00', &(0x7f00000006c0)=@ethtool_per_queue_op={0x4b, 0xe, [0x2, 0x5, 0x5, 0x0, 0x4, 0xb, 0x401, 0x7, 0x0, 0x0, 0x3, 0x8000, 0x3, 0x401, 0x5, 0x9, 0x5, 0x9, 0x9, 0x0, 0x7, 0x0, 0x3, 0xfffffff7, 0x0, 0xe, 0xe87, 0x10001, 0x1, 0x3, 0x0, 0x200, 0xc83, 0x1, 0xfffffffc, 0x6, 0xac79, 0x7, 0x6, 0x3, 0x4, 0xea, 0x0, 0x120000, 0x2, 0x6, 0x8, 0x2, 0x0, 0x7fff, 0x1, 0x1, 0xaf, 0x10000, 0xf42, 0x6, 0x81, 0xcd02, 0xb2df, 0x1, 0x6, 0x7, 0x5, 0x0, 0x2, 0x3, 0x400, 0x7fffffff, 0x6, 0x10000, 0x8, 0xdf, 0x10, 0x6a, 0x2, 0x6, 0x7, 0x40, 0x4adf, 0x7, 0x9, 0x9, 0x0, 0x4, 0x2, 0x8, 0x9, 0x6, 0x9, 0x8, 0xe, 0x1, 0xd, 0x0, 0x81e0, 0xf, 0x400, 0x4, 0x9, 0x2, 0x1, 0x3, 0x8, 0x4, 0x2, 0x6, 0xdaa, 0x5, 0xf9, 0x401, 0x1, 0x10001, 0x1, 0x1, 0x3f, 0x101, 0x4, 0x5da, 0xfff, 0x9, 0x7, 0x4, 0xee59, 0x4f65, 0x9, 0x9, 0x4267, 0x3], "b86ba95bff26a4ab277f85cebec2b98886ba70d6cdcf4dc9d4b783ce07a4f02e0d3a9f7819be11d953c2deca579d0ae75da58e634dd14874b358236d0db5204164940589475344d10610bb9b03daac10a2b44e5674c5063289af9d28011971b2cb38f1e237eaf70937d2"}}) setsockopt$inet_MCAST_MSFILTER(r2, 0x0, 0x30, &(0x7f0000000600)=ANY=[@ANYBLOB="020000000000000002000000e0000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000002"], 0x110) setsockopt$inet_group_source_req(r2, 0x0, 0x2c, &(0x7f00000004c0)={0x2, {{0x2, 0x0, @broadcast}}, {{0x2, 0x0, @private=0xa010101}}}, 0x108) setsockopt$inet_group_source_req(r2, 0x0, 0x2b, &(0x7f0000000000)={0x5, {{0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}}, {{0x2, 0x4e20, @multicast1}}}, 0x108) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000140)='freezer.self_freezing\x00', 0x0, 0x0) ioctl$PPPIOCCONNECT(r3, 0x4004743a, &(0x7f0000000240)=0x1) executing program 3: r0 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) sendmmsg$inet(r0, &(0x7f0000000200)=[{{&(0x7f0000000040)={0x2, 0x0, @empty}, 0x10, 0x0}}, {{&(0x7f0000000000)={0x2, 0x0, @empty=0x3000000}, 0x10, 0x0}}], 0x2, 0x0) (async) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0xd, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000000000008112a2000000000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xc, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) r1 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$netlink(r1, 0x10e, 0xa, &(0x7f0000000000)=""/97, &(0x7f0000000140)=0x61) (async) r2 = socket$inet6(0xa, 0x2, 0x0) (async, rerun: 32) sendto$phonet(0xffffffffffffffff, &(0x7f0000000540)="30a9ccac9ba5d5443128c891c5cdb485c1cd57b9bda8e4a7c1eafc28d4d8e7e2ecc52872519fefe1c8f404d8a5a2a049e9d1a0c569fe0fe9c73d31994f6f9f9e80add86cf885f87ef81018466a3b7540cd34f9e960c8ab0f9281f689fcda4833f5f23274e9cdeb", 0x67, 0x60044014, &(0x7f0000000600)={0x23, 0xac, 0xb, 0x9}, 0x10) (rerun: 32) r3 = socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000000000005000000180001801400020073797a5f74756e00000008000000000018000380140003801000018004000300080001"], 0x44}}, 0x0) (async) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)={0x38, r4, 0x7, 0x0, 0x0, {}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}, @ETHTOOL_A_LINKMODES_OURS={0xc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_BITS={0x4}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}]}, 0x38}}, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r2, 0x29, 0x23, &(0x7f0000000280)={{{@in=@remote, @in6=@private2, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x0, 0x16}}, {{@in6=@empty, 0x0, 0x2b}, 0x0, @in6=@mcast2}}, 0xe8) (async, rerun: 32) r5 = socket$key(0xf, 0x3, 0x2) (rerun: 32) setsockopt$sock_int(r5, 0x1, 0x8, &(0x7f00000001c0), 0x4) (async) sendmsg$key(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) (async) sendmsg$key(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)=ANY=[@ANYBLOB="0212000002"], 0x10}}, 0x0) (async) r6 = socket$netlink(0x10, 0x3, 0x6) writev(r6, &(0x7f00000001c0)=[{&(0x7f0000000000)="480000001500190a20ffff7fffffff5602113e850e1de0974881030491720000de213ee23ffbf510040041feff5aff2b0000000000000700"/68, 0x44}, {&(0x7f0000000080)="c1130389", 0x4}], 0x2) (async, rerun: 64) socketpair(0x1, 0x20000000000001, 0x0, &(0x7f0000000100)) (rerun: 64) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000900)=@newsa={0x184, 0x10, 0x1, 0x0, 0x0, {{@in=@initdev={0xac, 0x1e, 0x1, 0x0}, @in6=@local, 0x0, 0x0, 0x2000, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {@in=@multicast1, 0x0, 0x6c}, @in=@empty, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000000000000000}, {0x0, 0x4}, {}, 0x0, 0x0, 0x2, 0x1, 0x6}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @algo_aead={0x4c, 0x12, {{'gcm_base(ctr(aes-aesni),ghash-generic)\x00'}, 0x0, 0x80}}]}, 0x184}}, 0x0) (async) r8 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r8, 0x6, 0x80000000000002, &(0x7f00000000c0)=0x7b, 0x4) bind$inet(r8, &(0x7f0000000000)={0x2, 0x4e23, @broadcast}, 0x10) (async) sendto$inet(r8, 0x0, 0x0, 0x200007fd, &(0x7f0000000040)={0x2, 0x4e23, @dev={0xac, 0x14, 0x14, 0x13}}, 0x10) (async) setsockopt$sock_int(r8, 0x1, 0x8, &(0x7f0000000600), 0x4) (async) sendto$inet(r8, &(0x7f0000000700)="0c268a927f1f6588b967481241ba00600a34f65ac618ded8974897abeaf4b48344ab4ea6f7c555d88fecf90b037511bf746bec66ba", 0x35, 0x0, 0x0, 0x0) (async) recvmsg(r8, &(0x7f0000001500)={0x0, 0xa, &(0x7f0000002200)=[{&(0x7f00000035c0)=""/4106, 0x437aba2}], 0x1, 0x0, 0x46, 0x407006}, 0x104) setsockopt$inet_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f0000000380)='highspeed\x00', 0xa) executing program 1: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha384\x00'}, 0x58) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) r2 = socket(0x22, 0x2, 0x3) getsockopt$packet_buf(r2, 0x107, 0x1, &(0x7f0000000240)=""/1, &(0x7f0000002180)=0x1) sendmsg$nl_xfrm(r1, &(0x7f00000035c0)={0x0, 0x0, &(0x7f0000003580)={&(0x7f0000000a40)=ANY=[@ANYBLOB="6001000010000100000000000000000000000000000000000000000000000000fe8000000000000000000000000000bb0000fff720000001000000003b000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="64010102000000000000000000000000000000006c000000ac1414bb00000000000000000000000000000000000000000000008000000000000000000000000000000000000000000300000000000000000000000000000004000000000000e3ff000000000000000000000000000000040000000000000000000040000000000000000000000000000000ba9b55090000000000fcffffff0000000002000001000000000000000008001f0004000000480003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000008001f0003000000150008"], 0x160}}, 0x4810) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, 0x0, 0x0) r4 = gettid() ioctl$sock_SIOCSPGRP(r0, 0x8902, &(0x7f00000000c0)=r4) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0xc, 0xc, 0x2, [@func_proto]}}, 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xf, &(0x7f0000000580)=ANY=[@ANYBLOB="1800000000000000000000000023762edd35eaff10dcf502ededdaf4fcf9c0277f25470a209eef60517864e9b22c641f47b842b055bc37f7bdec65f11f2d929f9fa31a5ae8ac8bf9ccb57e8e926d2ecf7402b101cedd0de2d07b76bdc76923af38bd00141ec22689f9302f41069e3340f20dc912eba8b3fa49afd0b2bb65600babf555505935938b4c44f13d790352fed3ccbc8ed27c9933b0514b1227efc915531996d87aee1bd0790700000000000000f450411ca55a3fda77190ab66f04e250b6b036dfde", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000000000000b7000000000000009500000000000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'sha512\x00'}, 0x58) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) setsockopt$bt_l2cap_L2CAP_LM(r6, 0x6, 0x3, &(0x7f0000000000)=0xc, 0x4) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0xa43, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) r7 = accept4(r5, 0x0, 0x0, 0x0) sendmsg(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000380)="c130c435606b4e717ef9bcc0cb7cabc7029b4bc69e569bf13444be4593a12d83cff6cd2e2a767120cbf6405d5affc464e80d2abfa71bdad4d21a38e3294f60cc6bac3f725ae6b55723534dda54abf2254dc1e6aa96d263f5bde938c887292d36b72ec94b3934b96a8cec477adaaf6d4c3e437aa4d1251a15b5b5c1f3eae74bed98cf50aef2869f5360598077ea324263000beaa4e70f4f4f07511152439f397949270bb9ba6b276156e7fa81f0af3e1f0bad6305e8e122c1158b23fd46f0c5f3f2b8310b03b0ace1dd70307b226e432b2c8c819676d506c88522dcbee0266dacbf1bb481482a86be7b686d904e3858ff", 0xf0}], 0x1}, 0x0) setsockopt$ALG_SET_AEAD_AUTHSIZE(r0, 0x117, 0x5, 0x0, 0x7) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r7) r8 = socket$inet_udplite(0x2, 0x2, 0x88) socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHG6RD(r8, 0x89fb, &(0x7f0000000940)={'sit0\x00', &(0x7f0000000900)={@private2, @empty, 0x10, 0xd}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000280)=ANY=[@ANYBLOB="18080000000000000000000000000000851000000600000018020000", @ANYRESDEC=r7, @ANYBLOB="0000000000000000660002000000000018000000ffffffd000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000000)='GPL\x00', 0x2, 0xde, &(0x7f0000000340)=""/222, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) executing program 3: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0b00000008000000040000000400000001000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00 \x00'/28], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0), &(0x7f0000000140), 0x5, r0}, 0x38) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000040)={r0}, 0x20) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_inet6_tcp_SIOCOUTQNSD(r1, 0x894b, &(0x7f00000004c0)) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000000)={r0, &(0x7f0000000340)="ac9198ef219f7c9fff52e82d1774e900e1fd6214179d4ff06dea2ddca0d4f6a1d2adf1ccb1f058a1eaa38172e0a6222914a7da242f104cacaa8c886e47cf1550660356b738b5bf32d0db2f77da5ec035c649b706ed53831fdd1448aae431f38ded71fa89a87a07e9f2d794668662ca8326358b15fdc376f8abc33b2b413f0cf6f6deb51601a51265b0ec85cc9c6747d29e7f51d8c7c52074eba2a6ddb6584dba878e8baa8b67fafbbbfa6119f75e3f", &(0x7f0000000400)=""/146}, 0x20) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x40000, 0x0) ioctl$SIOCSIFHWADDR(r2, 0x8924, &(0x7f00000001c0)={'veth1_virt_wifi\x00', @local}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket(0x8, 0x2, 0xc) getsockname$packet(r4, &(0x7f0000000300)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000180)=0x14) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x9, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0xb, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[], 0x3c}, 0x1, 0x0, 0x0, 0x88eadb6ac961f7c6}, 0x0) r6 = socket$kcm(0x29, 0x5, 0x0) sendmsg$kcm(r6, &(0x7f0000002c00)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000002680)="d7", 0xfffffff9}], 0x1, &(0x7f0000003280)=ANY=[], 0x550}, 0x0) sendmmsg(r6, &(0x7f0000000580)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x2, 0x240028c1) socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r3, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000980)={&(0x7f0000000080)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="2bfafdffffff000000b30700000008002300", @ANYRES32=r8, @ANYBLOB="0800050007000000140004006e696376663000"/28], 0x38}}, 0x0) executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), r0) sendmsg$IEEE802154_LLSEC_LIST_DEV(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r1, 0x321}, 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000000079108700000000001e000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) executing program 2: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000cc0)=@delchain={0x198, 0x65, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x4, 0x9}, {0x0, 0xb}}, [@TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @TCA_CHAIN={0x8}, @filter_kind_options=@f_route={{0xa}, {0x150, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0xffff, 0xd}}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0x134, 0x6, [@m_nat={0x84, 0x20, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @rand_addr, @loopback}}]}, {0x31, 0x6, "3eaed48f5023f5c36bc9d8619f3e2af20800000000000000a40bc384135c74eb813bf1cf69dbeaddd76b564e92"}, {0xc}, {0xc}}}, @m_connmark={0x40, 0x0, 0x0, 0x0, {{0xd}, {0x4}, {0xd, 0x6, "66396e732cf67237ec"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_bpf={0x6c, 0x0, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6}]}, {0x3b, 0x6, "ca8fd735f4c425bd44291fa86781920ab90ff95c64e3d33704248d0546950f6c3113358c2551981c52f5a6dd8a3891697d8ab8d8f56d15"}, {0xc}, {0xc}}}]}]}}]}, 0x198}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@gettclass={0x24, 0x2a, 0x10, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xc, 0xa}, {0x10, 0xc}, {0x1, 0xb}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a0b0400000000000000000200000048000480440001800c0001007061796c6f616400340002800800054000000000080002400000000008000440000000000800034000000000080008400400000008000740000000000900010073797a30000000000900020073797a32"], 0x9c}}, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc000000850000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc000000850000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = socket(0x10, 0x3, 0x0) connect$netlink(r1, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x1}, 0xc) r2 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) (async) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000020c0)=@newqdisc={0x58, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7, 0x80, 0x0, 0x1000, 0x2, 0x7fffffff, 0x10088}}, {0x4}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x8800}, 0x0) connect$packet(r1, &(0x7f0000000180)={0x11, 0x1a, r4, 0x1, 0xf, 0x6, @broadcast}, 0x14) (async) connect$packet(r1, &(0x7f0000000180)={0x11, 0x1a, r4, 0x1, 0xf, 0x6, @broadcast}, 0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2300, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x2c, 0x1d, 0xa, 0x805, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0x74}}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) executing program 2: setsockopt(0xffffffffffffffff, 0x84, 0x81, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x1c0, 0xc8, 0x8, 0x0, 0x5803, 0x320, 0x2e8, 0x2e8, 0x320, 0x2e8, 0x3, 0x0, {[{{@ipv6={@remote, @empty, [], [], 'vlan0\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1c0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1, 0x6}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@ipv6header={{0x28}}, @common=@eui64={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x2, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r2) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac1414aa00000000000000001400020002000000e000000200000000000004000d0001007564703a73"], 0x54}}, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "000005", 0x14, 0x6, 0x0, @private0, @mcast1={0xff, 0x10}, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000080)) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r1, @ANYBLOB="db1d88550ca4406693d6b64e9ec37be08d3159073be620db49c84bad3d96755c115d573ca22ae33db16a94afca6ac6516453070913106c4006cfc85ebe1224712df4de6c38a068580a0679879631978a7ad6ccd76147185d50367e551eabc1fe7142401543fd2e7e4f88bcfa946d1b4f48790efd4119da38e772b4d8464470fcd9878d2c3265cd0b5a0d57ed08bfd8f6435ef247341f1ed1368acc9acc97e76a98ccbb711546"], 0x38}}, 0x0) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r1) (async) r2 = socket$unix(0x1, 0x2, 0x0) connect$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000340), 0x4) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000440)=0x82, 0x49) (async) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) (async) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x3f) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x1000001, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x4, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000dd0a0000000000006301410000000000950000004d000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x300, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r4 = openat$cgroup_devices(r3, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB='c 122', @ANYRESHEX], 0xa) (async) r5 = socket$l2tp6(0xa, 0x2, 0x73) sendto$l2tp6(r5, 0x0, 0x0, 0x4008814, &(0x7f0000000100)={0xa, 0x0, 0x8, @private1}, 0x20) sendto$inet(r0, &(0x7f0000000480)="fbbf0b5044e308cb7bd572aa2b42e9678bcf30eff9f3aed14dc94a114bd2b45956aebe2b108a87e865501a5f9e0383611afdd3f8bac3d5cfd7772a3ab48d0ba4b600731e357e38716c449fae7c28548a4f2105f44b8fd9b33041270ae01f1a405e3f650fc3b0926d481c364fca00000000000000006d3a3ede9fc738b8d86209c060161d5ddb5fcf3d09001117cdb9d055aa2d89fe3458720724853a876448d4a1fe9ef0569ad98a05ab5df763923b4e2c576e00000000000000000000000000000000002090666159e3075f7244cf4ec3d7814c0c934f44e200219e6dd7bc23397d5f2f2c76a5baddd0fd8c340362691ef226f7a0ac51b74b6be5ed6737948514cd466943d08eeb3895b80499da2b209da4f3ec5e3744ce3e863b0e04d0ec2f39edf50b6e08c4b47e448a35414763d687fbe3792ee15c5b9791310a346472723c100bf77a310b0ced8004b5ac6d48c40439f512e8ef34a53d65f55563f68136a577736ca5f6f66e01ef4ec2cdc8db34f6de50713adaa3f70189958263fddc1314f8a28ccdef6e1390c5fbaeadc3035d019f0dc75de307de6c0d010000000000000027083d1d5b4b013c503b863b560688d94de886b6dc73d5da2dfeff4bed1a49a975a6c8dbb480e4415ddca5657a5a8e3b111015499e952bb5e8d8f60de3d688df7802c6e8b27b31fac4e199038b79a3999920e634a5af162a9581b0e6647e410700246548234acacf9cb43ab332a37bbc926c39897395c974fda31536be523bf4260300730ae6136fecae5f0fa6ab2df8d98128b24589e3bbe5230e07dc5e0d65cc397e3f8204d48e59e8e294a6d7008ba8fba28cd5009fe1a7c569ce740078bf1c7389a6ba0f89257f0eac417aac0d2d89b05ee5dafa2f1d936c87264d077b2c0d5abdbc64ce943f895dd4c2e9dd7393543d89b00dc6b3a25045d4ec932366c67dfad087fa8dc104644828440bdf67dd97ebccb3bd", 0xfffffea5, 0xc000, 0x0, 0xfffffcef) (async) recvmsg(r0, &(0x7f00000033c0)={&(0x7f00000003c0)=@ethernet={0x0, @dev}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000080)=""/46, 0x31}, {&(0x7f00000021c0)=""/4087, 0x1000}, {&(0x7f0000000f80)=""/4096, 0xfffffffffffffe12}, {&(0x7f0000000280)=""/102, 0x66}], 0x4, &(0x7f0000001f80)=""/178, 0xb2}, 0x10120) (async) sendmsg$unix(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000140)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000800), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r0, @ANYBLOB="000000004540ad18a4661c2f407b9c4fcebad02fb2c7d2e50aac244f79a9a13b0fbc5ad117f44b643feb63a8221b083ca83b4e54552af30275f13b19b99e403ec58429d977d953d0ceaaa161bca3904e7640ab8316e4c00e71d3669857db2c968be3418d5a645f490997bbfbcb9d47a399ef4653f889741c006c1a76f257257913699156ef44a988083cac80cf5c249f8c8852bc42024de815ab3e"], 0x28, 0x4}, 0x48900) executing program 0: r0 = socket(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x10000000, 0x1, 0x7}}]}}]}, 0x44}}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000240)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000280)={r4, 0x11, 0x6, @local}, 0x10) (async) close(r3) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@getaddr={0x14, 0x16, 0x10, 0x70bd25, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x48001) executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="3b000000010006", 0x7) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x2, 0x2, 0x0, 0x3, 0x11, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}, @sadb_x_sa2={0x2, 0x9}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @sadb_x_sec_ctx={0x1, 0x18, 0x4}]}, 0x88}}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) (async) write(r0, &(0x7f0000000000)="3b000000010006", 0x7) (async) socket$key(0xf, 0x3, 0x2) (async) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x2, 0x2, 0x0, 0x3, 0x11, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}, @sadb_x_sa2={0x2, 0x9}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @sadb_x_sec_ctx={0x1, 0x18, 0x4}]}, 0x88}}, 0x0) (async) executing program 3: bind$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4a23}, 0xffffff52) executing program 0: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r1, &(0x7f0000000180)="c2", 0x1, 0x24004400, &(0x7f0000000000)={0xa, 0x2, 0x0, @loopback}, 0x1c) shutdown(r1, 0x1) sendmmsg$inet6(r1, &(0x7f0000001040)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001700)='\x00', 0x1}], 0x1}}], 0x1, 0x80) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x60, r0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x2c, 0x51, 0x0, 0x1, [{0x80, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "02d0e86cbe4d68f75ce39f0dab"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac09}, @NL80211_KEY_IDX={0x5}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x60}}, 0x0) executing program 4: r0 = socket(0x2, 0x3, 0xff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan0\x00', 0x0}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @broadcast}, 0x10) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000200)={r1, 0x3, 0x6}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x30, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x30}}, 0x0) socket(0x2, 0x3, 0xff) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan0\x00'}) (async) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @broadcast}, 0x10) (async) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000200)={r1, 0x3, 0x6}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x30, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x30}}, 0x0) (async) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000004100)={0x0, 0x0, &(0x7f00000040c0)={&(0x7f0000003f40)={0x38, 0x1, 0x2, 0x301, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @empty}}}]}]}, 0x38}}, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f30000000170a0017e9ffffff040037000900030001632564b7587ed2e7a6b9a64411f6bb744dc48f577c6ea6db125082897bbe546bab98f93551386ebb855ebd0104a1c57c555077d9e9a97cdda034ad1ea13696ea6497c3167f16809f3083e04fa419a65932e04a4c0c629c7c1e30dedc276d834e", 0x89}], 0x1) r2 = openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000100)={'b', ' *:* ', 'rw\x00'}, 0x9) socket$kcm(0x10, 0x2, 0x0) executing program 4: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)={0x108, 0x2c, 0x1, 0x0, 0x0, "", [@generic="d447ec83996c742d2879d6f82b672953c4d108d89a0a34d1da826756b314505a6de4c35c903500ea24092f972070b9b26899ae6ccbe3540e575a9a0043356abcd457456d69b5a8652d0a23b9ff427b2a59351cc877562f7bafa5a29b0ff9de83e051b6512bdd460ffd7f93c4af3b1bc164fe4350d9bc7d38983b56664980540c9e70557bde18a53cb4ebc30ad451f7b0845448441a2fb9b551358a535349101f9ff708cc3c8da103302f23fbcdc66535a3354b5ab32f63b520ad7b03bfe1167c4a037ca59942b8cb7a39005557cbd86f17e5be6f3d6863eb4a15c530581c44fc790cd85fe06f46c7b71e56eae90da5fae7398f9a", @nested={0x4, 0x19}]}, 0x108}], 0x1}, 0x0) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x65, &(0x7f00000019c0)=0x1, 0x4) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f0000000000), 0x8) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0xe20, 0x0, @local}, 0x1c) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x40d, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x680de}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}]}, 0x34}}, 0x0) executing program 2: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000022c0)='`', 0x1}], 0x1}}, {{&(0x7f0000000900)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, &(0x7f0000003580)=[{&(0x7f0000000940)='z', 0x1}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x1, &(0x7f0000001280)=""/4097, &(0x7f00000000c0)=0x1001) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r3, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r1}, 0x20) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0x18, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x3, 0x12}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}]}, 0x58}}, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000a00)=""/157, 0x9d}], 0x1}}], 0x1, 0x2, 0x0) r5 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4c, 0x2, [@TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_HH_FLOWS_LIMIT={0x8}, @TCA_HHF_NON_HH_WEIGHT={0x8}, @TCA_HHF_EVICT_TIMEOUT={0xfffffffffffffebc}, @TCA_HHF_RESET_TIMEOUT, @TCA_HHF_ADMIT_BYTES={0x8}, @TCA_HHF_EVICT_TIMEOUT={0x8}, @TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_ADMIT_BYTES={0x8}]}}]}, 0x78}}, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000080), 0x4) sendmmsg$sock(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="37718a623f9df45f31dee3a1dc342c86a363751e2b8d5e4f0d4366991cd78e840aa76b6cc4c63fcea7aba2813a20b7a2c7c4bee81f3edbddf68bed731be31afb85e879aadbc214c3dfb7fc9cb0c52bac4ad7d2d4fda74ca2b8385c3e7ef5bb18296e3e7f0e17aee30701bc68474f9fc355cd1d3f69c24a24cbfa0f8b69e8a311ef1d31e4fea8fac084d8cd6eafae5cd7b3d4985cf163bf8067c8b3dbda5a5df6369be1d5db4a30e4", 0xa8}, {&(0x7f0000000040)}, {&(0x7f00000001c0)="fc8c", 0x2}], 0x3, &(0x7f0000000240)=[@timestamping={{0x14, 0x1, 0x25, 0xaa9a}}, @mark={{0x14, 0x1, 0x24, 0x86}}, @txtime={{0x18, 0x1, 0x3d, 0x100000000}}, @timestamping={{0x14}}, @mark={{0x14, 0x1, 0x24, 0x1}}, @timestamping={{0x14, 0x1, 0x25, 0x38}}], 0x90}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="24c95064337c922c8c164da2d3ac1c93dc440b446ea96a429e967870bacdfa317054d2e68e378cd36370896a134615fb817e3ee1c9746f31ca97ad4f8a7c7ea806b5603df4e6412d9586489b60c9a0612d8d8694a965b437e9bae5292baa4f84444c38d895edf2f03c7ffa53d43bbf3e253e26cb4528b68dda1d4a06285c27ae8331185b9e8970d439aff19b61e2c8b669dcd596d47b63cd141b41f2f1a5b6e3c5ec87f43505cd0ec16c05938c9a08e87af6c264b10b2ca3fec32b2f4f454a225639343d7a7c42a39b0edd9e648e2f52bdc5f2e44d1c2b151de2ed1127379e15bd0867", 0xe3}, {&(0x7f0000000400)="2b55df4a0ebc042665f4198c7902a8212ef047ae1c8d9d04becf98ec5e3870bd9c5315d1e677218ca8c9a5a14a3b2513ff8ea328ef9365c6ad75cdab77a0b821f7d4274f29511515b7424ef646dbef4fd56f7b68b22c3e7e072d2d3e0af7281269058740ef17e2067df3a0fea3b401d6", 0x70}, {&(0x7f0000000480)="9d655d0ef05ccfd46889eba5008b91eadfe925bec05089f3c174a57f524d73dc3742009b7d7230c9887ec4bfa45994707bfa7e32afff8a24a25da6b9ed97b43bd2ccc92ae6ec7021d6a09bd5a3220f6f955662aa936c7ba1ad0bc5d013fb58fc3587e8", 0x63}, {&(0x7f0000000500)="f06224d1847875eae4a09b74f15bfb8f21f42b37dc8a1c357b00d98dd25a7d", 0x1f}, {&(0x7f0000000540)="3dd30a9230242dd2862a3cb1ea8d6b32fc722a51373b26656ab3f66015168225fd8b21fc69a607bdb55ecae975b89267f4dec2f8f0256507f1ab41d418c343ab7a7d946b091fbfea6a8cf290f11e1f6fe323b8ac1ef36e5a8f82f0ce144ddab9e06c1460bbcf9c1702611c36039cb5a768f14571ecb490127d290b041ceaa2bcf163d63093022ab5b03f380a2b833813df", 0x91}], 0x5, &(0x7f0000000680)=[@txtime={{0x18, 0x1, 0x3d, 0x5}}, @txtime={{0x18}}], 0x30}}], 0x2, 0x4004004) executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updsa={0x104, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private0, @in=@multicast2}, {@in6=@local, 0x1, 0x3c}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in6=@dev}]}, 0x104}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program crashed: general protection fault in cleanup_bearer bisect: bisecting 30 programs bisect: split chunks (needed=false): <30> bisect: split chunk #0 of len 30 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=6m5s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [4, 8, 16, 11, 5, 21, 10, 10, 1, 8, 16, 7, 2, 7, 19, 6, 3, 24, 5, 9] detailed listing: executing program 2: r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000740), r0) sendmsg$IEEE802154_LLSEC_LIST_DEV(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x14, r1, 0x321}, 0x14}}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b40500000000000079108700000000001e000000000000009500000000000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x22e, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) executing program 2: sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000cc0)=@delchain={0x198, 0x65, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x2, 0x2}, {0x4, 0x9}, {0x0, 0xb}}, [@TCA_CHAIN={0x8}, @TCA_RATE={0x6}, @TCA_CHAIN={0x8}, @filter_kind_options=@f_route={{0xa}, {0x150, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0xffff, 0xd}}, @TCA_ROUTE4_FROM={0x8}, @TCA_ROUTE4_IIF={0x8}, @TCA_ROUTE4_ACT={0x134, 0x6, [@m_nat={0x84, 0x20, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{}, @rand_addr, @loopback}}]}, {0x31, 0x6, "3eaed48f5023f5c36bc9d8619f3e2af20800000000000000a40bc384135c74eb813bf1cf69dbeaddd76b564e92"}, {0xc}, {0xc}}}, @m_connmark={0x40, 0x0, 0x0, 0x0, {{0xd}, {0x4}, {0xd, 0x6, "66396e732cf67237ec"}, {0xc}, {0xc, 0x8, {0x0, 0x1}}}}, @m_bpf={0x6c, 0x0, 0x0, 0x0, {{0x8}, {0xc, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_OPS_LEN={0x6}]}, {0x3b, 0x6, "ca8fd735f4c425bd44291fa86781920ab90ff95c64e3d33704248d0546950f6c3113358c2551981c52f5a6dd8a3891697d8ab8d8f56d15"}, {0xc}, {0xc}}}]}]}}]}, 0x198}, 0x1, 0x0, 0x0, 0x81}, 0x0) r0 = socket(0x10, 0x803, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000100)={&(0x7f00000000c0)=@gettclass={0x24, 0x2a, 0x10, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, {0xc, 0xa}, {0x10, 0xc}, {0x1, 0xb}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x4}, 0x20000800) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a0b0400000000000000000200000048000480440001800c0001007061796c6f616400340002800800054000000000080002400000000008000440000000000800034000000000080008400400000008000740000000000900010073797a30000000000900020073797a32"], 0x9c}}, 0x0) sendto(r0, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x14}, {&(0x7f00000007c0)=""/154, 0x21}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) executing program 3: bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc000000850000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x6, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc000000850000000800000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r1 = socket(0x10, 0x3, 0x0) connect$netlink(r1, &(0x7f00000014c0)=@proc={0x10, 0x0, 0x1}, 0xc) r2 = socket(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) (async) r3 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000020c0)=@newqdisc={0x58, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x4}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x7, 0x80, 0x0, 0x1000, 0x2, 0x7fffffff, 0x10088}}, {0x4}}]}]}, 0x58}, 0x1, 0x0, 0x0, 0x8800}, 0x0) connect$packet(r1, &(0x7f0000000180)={0x11, 0x1a, r4, 0x1, 0xf, 0x6, @broadcast}, 0x14) (async) connect$packet(r1, &(0x7f0000000180)={0x11, 0x1a, r4, 0x1, 0xf, 0x6, @broadcast}, 0x14) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0x2300, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x801, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSETELEM={0x2c, 0x1d, 0xa, 0x805, 0x0, 0x0, {0x1}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x10}}, 0x74}}, 0x0) socket$pppl2tp(0x18, 0x1, 0x1) executing program 2: setsockopt(0xffffffffffffffff, 0x84, 0x81, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(0xffffffffffffffff, 0x84, 0x18, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x4000) r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$IP6T_SO_SET_REPLACE(r0, 0x29, 0x40, &(0x7f0000000140)=@raw={'raw\x00', 0x3c1, 0x3, 0x3f0, 0x1c0, 0xc8, 0x8, 0x0, 0x5803, 0x320, 0x2e8, 0x2e8, 0x320, 0x2e8, 0x3, 0x0, {[{{@ipv6={@remote, @empty, [], [], 'vlan0\x00', 'geneve1\x00'}, 0x0, 0x190, 0x1c0, 0x0, {0x0, 0x2000000000000}, [@common=@unspec=@string={{0xc0}, {0x0, 0x0, 'bm\x00', "cfcaf80c672f61cd17ae5119b5135c2aee68d23a465cd431e1ecef50c3234e082555f67222476147864fa03182f5df11d8c348cbd06dc8de1dcbde7d4e252c3394fed47bf78c70f607b0178fa5ea335019ac07a602061c96baebc989f1f35a214e67262c1fe4b124e0f7323a587d2a1fcfe36bbf12eca0a7b66c60c527bac2b5", 0x1, 0x6}}, @common=@inet=@socket1={{0x28}}]}, @common=@unspec=@CONNMARK={0x30}}, {{@uncond, 0x0, 0xf8, 0x160, 0x0, {}, [@common=@ipv6header={{0x28}}, @common=@eui64={{0x28}}]}, @unspec=@CT1={0x68, 'CT\x00', 0x1, {0x2, 0x0, 0x0, 0x0, 'netbios-ns\x00', 'syz1\x00'}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x450) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IP_VS_SO_SET_ADD(r1, 0x0, 0x482, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000000c0), r2) sendmsg$TIPC_NL_KEY_SET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB='T\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="0100000000000000000003000000400001802c0004001400010002000000ac1414aa00000000000000001400020002000000e000000200000000000004000d0001007564703a73"], 0x54}}, 0x0) executing program 0: r0 = socket(0x10, 0x3, 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000380)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @remote, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "000005", 0x14, 0x6, 0x0, @private0, @mcast1={0xff, 0x10}, {[], {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000080)) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r1, @ANYBLOB="db1d88550ca4406693d6b64e9ec37be08d3159073be620db49c84bad3d96755c115d573ca22ae33db16a94afca6ac6516453070913106c4006cfc85ebe1224712df4de6c38a068580a0679879631978a7ad6ccd76147185d50367e551eabc1fe7142401543fd2e7e4f88bcfa946d1b4f48790efd4119da38e772b4d8464470fcd9878d2c3265cd0b5a0d57ed08bfd8f6435ef247341f1ed1368acc9acc97e76a98ccbb711546"], 0x38}}, 0x0) executing program 3: r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket$unix(0x1, 0x2, 0x0) bind$unix(r1, &(0x7f0000000080)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) close(r1) (async) r2 = socket$unix(0x1, 0x2, 0x0) connect$unix(r2, &(0x7f0000000180)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) (async) setsockopt$sock_int(r0, 0x1, 0x2f, &(0x7f0000000340), 0x4) (async) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f0000000440)=0x82, 0x49) (async) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @local}, 0x10) (async) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x3f) mmap(&(0x7f0000000000/0x95c000)=nil, 0x95c000, 0x1000001, 0x8c4b815a5465c2b1, 0xffffffffffffffff, 0x0) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x4, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000000000dd0a0000000000006301410000000000950000004d000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x19, &(0x7f0000000000), 0xb5, 0x10, &(0x7f0000000000), 0x7, 0x0, 0xffffffffffffffff, 0x300, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) (async) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) (async) r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r4 = openat$cgroup_devices(r3, &(0x7f0000000300)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r4, &(0x7f00000000c0)=ANY=[@ANYBLOB='c 122', @ANYRESHEX], 0xa) (async) r5 = socket$l2tp6(0xa, 0x2, 0x73) sendto$l2tp6(r5, 0x0, 0x0, 0x4008814, &(0x7f0000000100)={0xa, 0x0, 0x8, @private1}, 0x20) sendto$inet(r0, &(0x7f0000000480)="fbbf0b5044e308cb7bd572aa2b42e9678bcf30eff9f3aed14dc94a114bd2b45956aebe2b108a87e865501a5f9e0383611afdd3f8bac3d5cfd7772a3ab48d0ba4b600731e357e38716c449fae7c28548a4f2105f44b8fd9b33041270ae01f1a405e3f650fc3b0926d481c364fca00000000000000006d3a3ede9fc738b8d86209c060161d5ddb5fcf3d09001117cdb9d055aa2d89fe3458720724853a876448d4a1fe9ef0569ad98a05ab5df763923b4e2c576e00000000000000000000000000000000002090666159e3075f7244cf4ec3d7814c0c934f44e200219e6dd7bc23397d5f2f2c76a5baddd0fd8c340362691ef226f7a0ac51b74b6be5ed6737948514cd466943d08eeb3895b80499da2b209da4f3ec5e3744ce3e863b0e04d0ec2f39edf50b6e08c4b47e448a35414763d687fbe3792ee15c5b9791310a346472723c100bf77a310b0ced8004b5ac6d48c40439f512e8ef34a53d65f55563f68136a577736ca5f6f66e01ef4ec2cdc8db34f6de50713adaa3f70189958263fddc1314f8a28ccdef6e1390c5fbaeadc3035d019f0dc75de307de6c0d010000000000000027083d1d5b4b013c503b863b560688d94de886b6dc73d5da2dfeff4bed1a49a975a6c8dbb480e4415ddca5657a5a8e3b111015499e952bb5e8d8f60de3d688df7802c6e8b27b31fac4e199038b79a3999920e634a5af162a9581b0e6647e410700246548234acacf9cb43ab332a37bbc926c39897395c974fda31536be523bf4260300730ae6136fecae5f0fa6ab2df8d98128b24589e3bbe5230e07dc5e0d65cc397e3f8204d48e59e8e294a6d7008ba8fba28cd5009fe1a7c569ce740078bf1c7389a6ba0f89257f0eac417aac0d2d89b05ee5dafa2f1d936c87264d077b2c0d5abdbc64ce943f895dd4c2e9dd7393543d89b00dc6b3a25045d4ec932366c67dfad087fa8dc104644828440bdf67dd97ebccb3bd", 0xfffffea5, 0xc000, 0x0, 0xfffffcef) (async) recvmsg(r0, &(0x7f00000033c0)={&(0x7f00000003c0)=@ethernet={0x0, @dev}, 0x80, &(0x7f0000000380)=[{&(0x7f0000000080)=""/46, 0x31}, {&(0x7f00000021c0)=""/4087, 0x1000}, {&(0x7f0000000f80)=""/4096, 0xfffffffffffffe12}, {&(0x7f0000000280)=""/102, 0x66}], 0x4, &(0x7f0000001f80)=""/178, 0xb2}, 0x10120) (async) sendmsg$unix(0xffffffffffffffff, &(0x7f00000008c0)={&(0x7f0000000140)=@abs={0x1, 0x0, 0x4e21}, 0x6e, &(0x7f0000000800), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="24000000000000000100000001000000", @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32, @ANYRES32=r0, @ANYBLOB="000000004540ad18a4661c2f407b9c4fcebad02fb2c7d2e50aac244f79a9a13b0fbc5ad117f44b643feb63a8221b083ca83b4e54552af30275f13b19b99e403ec58429d977d953d0ceaaa161bca3904e7640ab8316e4c00e71d3669857db2c968be3418d5a645f490997bbfbcb9d47a399ef4653f889741c006c1a76f257257913699156ef44a988083cac80cf5c249f8c8852bc42024de815ab3e"], 0x28, 0x4}, 0x48900) executing program 0: r0 = socket(0x10, 0x3, 0x0) (async) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000a00)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'vlan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newqdisc={0x44, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xe}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x14, 0x2, [@TCA_GRED_DPS={0x10, 0x3, {0x10, 0x10000000, 0x1, 0x7}}]}}]}, 0x44}}, 0x0) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000240)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r3, 0x107, 0x1, &(0x7f0000000280)={r4, 0x11, 0x6, @local}, 0x10) (async) close(r3) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000080)={&(0x7f0000000040)=@getaddr={0x14, 0x16, 0x10, 0x70bd25, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x48001) executing program 2: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="3b000000010006", 0x7) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x2, 0x2, 0x0, 0x3, 0x11, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}, @sadb_x_sa2={0x2, 0x9}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @sadb_x_sec_ctx={0x1, 0x18, 0x4}]}, 0x88}}, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) (async) write(r0, &(0x7f0000000000)="3b000000010006", 0x7) (async) socket$key(0xf, 0x3, 0x2) (async) sendmsg$key(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)={0x2, 0x2, 0x0, 0x3, 0x11, 0x0, 0x0, 0x0, [@sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @remote}}, @sadb_sa={0x2, 0x1, 0x0, 0x0, 0x0, 0x0, 0xb}, @sadb_x_sa2={0x2, 0x9}, @sadb_address={0x5, 0x6, 0x0, 0x0, 0x0, @in6={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}}}, @sadb_x_sec_ctx={0x1, 0x18, 0x4}]}, 0x88}}, 0x0) (async) executing program 3: bind$unix(0xffffffffffffffff, &(0x7f0000000000)=@abs={0x1, 0x0, 0x4a23}, 0xffffff52) executing program 0: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) sendto$inet6(r1, &(0x7f0000000180)="c2", 0x1, 0x24004400, &(0x7f0000000000)={0xa, 0x2, 0x0, @loopback}, 0x1c) shutdown(r1, 0x1) sendmmsg$inet6(r1, &(0x7f0000001040)=[{{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f0000001700)='\x00', 0x1}], 0x1}}], 0x1, 0x80) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000480)={0x60, r0, 0x101, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_KEYS={0x2c, 0x51, 0x0, 0x1, [{0x80, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "02d0e86cbe4d68f75ce39f0dab"}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac09}, @NL80211_KEY_IDX={0x5}]}]}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x60}}, 0x0) executing program 4: r0 = socket(0x2, 0x3, 0xff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan0\x00', 0x0}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @broadcast}, 0x10) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000200)={r1, 0x3, 0x6}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x30, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x30}}, 0x0) socket(0x2, 0x3, 0xff) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan0\x00'}) (async) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @broadcast}, 0x10) (async) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000200)={r1, 0x3, 0x6}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x30, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x30}}, 0x0) (async) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000004100)={0x0, 0x0, &(0x7f00000040c0)={&(0x7f0000003f40)={0x38, 0x1, 0x2, 0x301, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @empty}}}]}]}, 0x38}}, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f30000000170a0017e9ffffff040037000900030001632564b7587ed2e7a6b9a64411f6bb744dc48f577c6ea6db125082897bbe546bab98f93551386ebb855ebd0104a1c57c555077d9e9a97cdda034ad1ea13696ea6497c3167f16809f3083e04fa419a65932e04a4c0c629c7c1e30dedc276d834e", 0x89}], 0x1) r2 = openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000100)={'b', ' *:* ', 'rw\x00'}, 0x9) socket$kcm(0x10, 0x2, 0x0) executing program 4: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)={0x108, 0x2c, 0x1, 0x0, 0x0, "", [@generic="d447ec83996c742d2879d6f82b672953c4d108d89a0a34d1da826756b314505a6de4c35c903500ea24092f972070b9b26899ae6ccbe3540e575a9a0043356abcd457456d69b5a8652d0a23b9ff427b2a59351cc877562f7bafa5a29b0ff9de83e051b6512bdd460ffd7f93c4af3b1bc164fe4350d9bc7d38983b56664980540c9e70557bde18a53cb4ebc30ad451f7b0845448441a2fb9b551358a535349101f9ff708cc3c8da103302f23fbcdc66535a3354b5ab32f63b520ad7b03bfe1167c4a037ca59942b8cb7a39005557cbd86f17e5be6f3d6863eb4a15c530581c44fc790cd85fe06f46c7b71e56eae90da5fae7398f9a", @nested={0x4, 0x19}]}, 0x108}], 0x1}, 0x0) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x65, &(0x7f00000019c0)=0x1, 0x4) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f0000000000), 0x8) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0xe20, 0x0, @local}, 0x1c) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x40d, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x680de}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}]}, 0x34}}, 0x0) executing program 2: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000022c0)='`', 0x1}], 0x1}}, {{&(0x7f0000000900)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, &(0x7f0000003580)=[{&(0x7f0000000940)='z', 0x1}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x1, &(0x7f0000001280)=""/4097, &(0x7f00000000c0)=0x1001) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r3, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r1}, 0x20) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0x18, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x3, 0x12}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}]}, 0x58}}, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000a00)=""/157, 0x9d}], 0x1}}], 0x1, 0x2, 0x0) r5 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4c, 0x2, [@TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_HH_FLOWS_LIMIT={0x8}, @TCA_HHF_NON_HH_WEIGHT={0x8}, @TCA_HHF_EVICT_TIMEOUT={0xfffffffffffffebc}, @TCA_HHF_RESET_TIMEOUT, @TCA_HHF_ADMIT_BYTES={0x8}, @TCA_HHF_EVICT_TIMEOUT={0x8}, @TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_ADMIT_BYTES={0x8}]}}]}, 0x78}}, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000080), 0x4) sendmmsg$sock(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="37718a623f9df45f31dee3a1dc342c86a363751e2b8d5e4f0d4366991cd78e840aa76b6cc4c63fcea7aba2813a20b7a2c7c4bee81f3edbddf68bed731be31afb85e879aadbc214c3dfb7fc9cb0c52bac4ad7d2d4fda74ca2b8385c3e7ef5bb18296e3e7f0e17aee30701bc68474f9fc355cd1d3f69c24a24cbfa0f8b69e8a311ef1d31e4fea8fac084d8cd6eafae5cd7b3d4985cf163bf8067c8b3dbda5a5df6369be1d5db4a30e4", 0xa8}, {&(0x7f0000000040)}, {&(0x7f00000001c0)="fc8c", 0x2}], 0x3, &(0x7f0000000240)=[@timestamping={{0x14, 0x1, 0x25, 0xaa9a}}, @mark={{0x14, 0x1, 0x24, 0x86}}, @txtime={{0x18, 0x1, 0x3d, 0x100000000}}, @timestamping={{0x14}}, @mark={{0x14, 0x1, 0x24, 0x1}}, @timestamping={{0x14, 0x1, 0x25, 0x38}}], 0x90}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="24c95064337c922c8c164da2d3ac1c93dc440b446ea96a429e967870bacdfa317054d2e68e378cd36370896a134615fb817e3ee1c9746f31ca97ad4f8a7c7ea806b5603df4e6412d9586489b60c9a0612d8d8694a965b437e9bae5292baa4f84444c38d895edf2f03c7ffa53d43bbf3e253e26cb4528b68dda1d4a06285c27ae8331185b9e8970d439aff19b61e2c8b669dcd596d47b63cd141b41f2f1a5b6e3c5ec87f43505cd0ec16c05938c9a08e87af6c264b10b2ca3fec32b2f4f454a225639343d7a7c42a39b0edd9e648e2f52bdc5f2e44d1c2b151de2ed1127379e15bd0867", 0xe3}, {&(0x7f0000000400)="2b55df4a0ebc042665f4198c7902a8212ef047ae1c8d9d04becf98ec5e3870bd9c5315d1e677218ca8c9a5a14a3b2513ff8ea328ef9365c6ad75cdab77a0b821f7d4274f29511515b7424ef646dbef4fd56f7b68b22c3e7e072d2d3e0af7281269058740ef17e2067df3a0fea3b401d6", 0x70}, {&(0x7f0000000480)="9d655d0ef05ccfd46889eba5008b91eadfe925bec05089f3c174a57f524d73dc3742009b7d7230c9887ec4bfa45994707bfa7e32afff8a24a25da6b9ed97b43bd2ccc92ae6ec7021d6a09bd5a3220f6f955662aa936c7ba1ad0bc5d013fb58fc3587e8", 0x63}, {&(0x7f0000000500)="f06224d1847875eae4a09b74f15bfb8f21f42b37dc8a1c357b00d98dd25a7d", 0x1f}, {&(0x7f0000000540)="3dd30a9230242dd2862a3cb1ea8d6b32fc722a51373b26656ab3f66015168225fd8b21fc69a607bdb55ecae975b89267f4dec2f8f0256507f1ab41d418c343ab7a7d946b091fbfea6a8cf290f11e1f6fe323b8ac1ef36e5a8f82f0ce144ddab9e06c1460bbcf9c1702611c36039cb5a768f14571ecb490127d290b041ceaa2bcf163d63093022ab5b03f380a2b833813df", 0x91}], 0x5, &(0x7f0000000680)=[@txtime={{0x18, 0x1, 0x3d, 0x5}}, @txtime={{0x18}}], 0x30}}], 0x2, 0x4004004) executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updsa={0x104, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private0, @in=@multicast2}, {@in6=@local, 0x1, 0x3c}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in6=@dev}]}, 0x104}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program crashed: general protection fault in cleanup_bearer bisect: the chunk can be dropped bisect: testing without sub-chunk 2/3 testing program (duration=6m2s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [16, 7, 2, 7, 19, 6, 3, 24, 5, 9] detailed listing: executing program 4: r0 = socket(0x2, 0x3, 0xff) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan0\x00', 0x0}) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @broadcast}, 0x10) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000200)={r1, 0x3, 0x6}, 0x10) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x30, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x30}}, 0x0) socket(0x2, 0x3, 0xff) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'vlan0\x00'}) (async) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f00000004c0)={r1, 0x3, 0x6, @broadcast}, 0x10) (async) setsockopt$packet_add_memb(0xffffffffffffffff, 0x107, 0x1, &(0x7f0000000200)={r1, 0x3, 0x6}, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000180)={'wlan0\x00'}) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) (async) sendmsg$NL80211_CMD_SET_STATION(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000680)={0x30, r4, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_PLINK_ACTION={0x5, 0x19, 0x2}]}, 0x30}}, 0x0) (async) executing program 3: r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000004100)={0x0, 0x0, &(0x7f00000040c0)={&(0x7f0000003f40)={0x38, 0x1, 0x2, 0x301, 0x0, 0x0, {0x2}, [@CTA_EXPECT_MASTER={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}, @CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @loopback}, {0x8, 0x2, @empty}}}]}]}, 0x38}}, 0x0) writev(r0, &(0x7f0000000340)=[{&(0x7f0000000000)="390000001000111867090707a640400f0021ff3f30000000170a0017e9ffffff040037000900030001632564b7587ed2e7a6b9a64411f6bb744dc48f577c6ea6db125082897bbe546bab98f93551386ebb855ebd0104a1c57c555077d9e9a97cdda034ad1ea13696ea6497c3167f16809f3083e04fa419a65932e04a4c0c629c7c1e30dedc276d834e", 0x89}], 0x1) r2 = openat$cgroup_devices(r1, &(0x7f00000000c0)='devices.deny\x00', 0x2, 0x0) write$cgroup_devices(r2, &(0x7f0000000100)={'b', ' *:* ', 'rw\x00'}, 0x9) socket$kcm(0x10, 0x2, 0x0) executing program 4: r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)={0x108, 0x2c, 0x1, 0x0, 0x0, "", [@generic="d447ec83996c742d2879d6f82b672953c4d108d89a0a34d1da826756b314505a6de4c35c903500ea24092f972070b9b26899ae6ccbe3540e575a9a0043356abcd457456d69b5a8652d0a23b9ff427b2a59351cc877562f7bafa5a29b0ff9de83e051b6512bdd460ffd7f93c4af3b1bc164fe4350d9bc7d38983b56664980540c9e70557bde18a53cb4ebc30ad451f7b0845448441a2fb9b551358a535349101f9ff708cc3c8da103302f23fbcdc66535a3354b5ab32f63b520ad7b03bfe1167c4a037ca59942b8cb7a39005557cbd86f17e5be6f3d6863eb4a15c530581c44fc790cd85fe06f46c7b71e56eae90da5fae7398f9a", @nested={0x4, 0x19}]}, 0x108}], 0x1}, 0x0) executing program 0: r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x2, 0x0) r2 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r2, 0x11, 0x65, &(0x7f00000019c0)=0x1, 0x4) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f0000000000), 0x8) sendto$inet6(r1, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0xe20, 0x0, @local}, 0x1c) sendmsg$nl_route(r0, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=@newlink={0x34, 0x10, 0x40d, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x680de}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @lowpan={{0xb}, {0x4}}}]}, 0x34}}, 0x0) executing program 2: r0 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r0, &(0x7f0000002300)=[{{&(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}, 0x1c, &(0x7f0000000080)=[{&(0x7f00000022c0)='`', 0x1}], 0x1}}, {{&(0x7f0000000900)={0xa, 0x0, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c, &(0x7f0000003580)=[{&(0x7f0000000940)='z', 0x1}], 0x1}}], 0x2, 0x0) shutdown(r0, 0x1) getsockopt$bt_hci(r0, 0x84, 0x1, &(0x7f0000001280)=""/4097, &(0x7f00000000c0)=0x1001) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) listen(r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000700)=ANY=[@ANYBLOB="b4050000200080006110600000000000c60000000000000095000000000000009f33ef60916e6e893f1eeb0be20000d072f5b89c3043c47c896ce0bc8731fa595b6b4d45ef26dcca5582054d54d53cd2b685b431c70ea948259c4c869b4fc8db714e4b94bdae214fa68a051d4dca7d2647bec1fc89398d2b9000f224891060017c4700de60beac671e8e8f00cb03588aa6007e71f871ab5c2ff88afc6002084e5b52710aeee835cf0d78e45f70983826fb8579c1fb47d2c59005cff414ed55b0d18a9d446935fb332bb593ee341ab59016f81860324b800c00000000000092d9c5fe34ccb80a61ffcb3363073fd8962823ee45f5d7394e9510f4ac6c702cfabe8a9c55c8dafcdb110036e14c1035cafdfef6a358cbfadb3579a285580a3c080d4e0a48d7bdc38a0437c8c1b3aa408a0000000000002248950b000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000ac0)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB='&'], 0x10) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f00000048c0)={r3, &(0x7f00000047c0), &(0x7f0000004880)=@udp=r1}, 0x20) r4 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r4, &(0x7f00000014c0)={0x2, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x2, 0x18, 0x0, 0x0, 0xb, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x5, 0x0, 0x0, 0x0, @in={0x2, 0x0, @multicast1}}, @sadb_address={0x3, 0x12}, @sadb_address={0x3, 0x6, 0x0, 0x0, 0x0, @in={0x2, 0x0, @broadcast}}]}, 0x58}}, 0x0) recvmmsg(r1, &(0x7f0000002100)=[{{0x0, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000a00)=""/157, 0x9d}], 0x1}}], 0x1, 0x2, 0x0) r5 = socket(0x11, 0x800000003, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r5, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000000)=@newqdisc={0x78, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x12, r6, {}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4c, 0x2, [@TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_HH_FLOWS_LIMIT={0x8}, @TCA_HHF_NON_HH_WEIGHT={0x8}, @TCA_HHF_EVICT_TIMEOUT={0xfffffffffffffebc}, @TCA_HHF_RESET_TIMEOUT, @TCA_HHF_ADMIT_BYTES={0x8}, @TCA_HHF_EVICT_TIMEOUT={0x8}, @TCA_HHF_RESET_TIMEOUT={0x8}, @TCA_HHF_ADMIT_BYTES={0x8}]}}]}, 0x78}}, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x19, &(0x7f0000000080), 0x4) sendmmsg$sock(r0, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000100)="37718a623f9df45f31dee3a1dc342c86a363751e2b8d5e4f0d4366991cd78e840aa76b6cc4c63fcea7aba2813a20b7a2c7c4bee81f3edbddf68bed731be31afb85e879aadbc214c3dfb7fc9cb0c52bac4ad7d2d4fda74ca2b8385c3e7ef5bb18296e3e7f0e17aee30701bc68474f9fc355cd1d3f69c24a24cbfa0f8b69e8a311ef1d31e4fea8fac084d8cd6eafae5cd7b3d4985cf163bf8067c8b3dbda5a5df6369be1d5db4a30e4", 0xa8}, {&(0x7f0000000040)}, {&(0x7f00000001c0)="fc8c", 0x2}], 0x3, &(0x7f0000000240)=[@timestamping={{0x14, 0x1, 0x25, 0xaa9a}}, @mark={{0x14, 0x1, 0x24, 0x86}}, @txtime={{0x18, 0x1, 0x3d, 0x100000000}}, @timestamping={{0x14}}, @mark={{0x14, 0x1, 0x24, 0x1}}, @timestamping={{0x14, 0x1, 0x25, 0x38}}], 0x90}}, {{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f0000000300)="24c95064337c922c8c164da2d3ac1c93dc440b446ea96a429e967870bacdfa317054d2e68e378cd36370896a134615fb817e3ee1c9746f31ca97ad4f8a7c7ea806b5603df4e6412d9586489b60c9a0612d8d8694a965b437e9bae5292baa4f84444c38d895edf2f03c7ffa53d43bbf3e253e26cb4528b68dda1d4a06285c27ae8331185b9e8970d439aff19b61e2c8b669dcd596d47b63cd141b41f2f1a5b6e3c5ec87f43505cd0ec16c05938c9a08e87af6c264b10b2ca3fec32b2f4f454a225639343d7a7c42a39b0edd9e648e2f52bdc5f2e44d1c2b151de2ed1127379e15bd0867", 0xe3}, {&(0x7f0000000400)="2b55df4a0ebc042665f4198c7902a8212ef047ae1c8d9d04becf98ec5e3870bd9c5315d1e677218ca8c9a5a14a3b2513ff8ea328ef9365c6ad75cdab77a0b821f7d4274f29511515b7424ef646dbef4fd56f7b68b22c3e7e072d2d3e0af7281269058740ef17e2067df3a0fea3b401d6", 0x70}, {&(0x7f0000000480)="9d655d0ef05ccfd46889eba5008b91eadfe925bec05089f3c174a57f524d73dc3742009b7d7230c9887ec4bfa45994707bfa7e32afff8a24a25da6b9ed97b43bd2ccc92ae6ec7021d6a09bd5a3220f6f955662aa936c7ba1ad0bc5d013fb58fc3587e8", 0x63}, {&(0x7f0000000500)="f06224d1847875eae4a09b74f15bfb8f21f42b37dc8a1c357b00d98dd25a7d", 0x1f}, {&(0x7f0000000540)="3dd30a9230242dd2862a3cb1ea8d6b32fc722a51373b26656ab3f66015168225fd8b21fc69a607bdb55ecae975b89267f4dec2f8f0256507f1ab41d418c343ab7a7d946b091fbfea6a8cf290f11e1f6fe323b8ac1ef36e5a8f82f0ce144ddab9e06c1460bbcf9c1702611c36039cb5a768f14571ecb490127d290b041ceaa2bcf163d63093022ab5b03f380a2b833813df", 0x91}], 0x5, &(0x7f0000000680)=[@txtime={{0x18, 0x1, 0x3d, 0x5}}, @txtime={{0x18}}], 0x30}}], 0x2, 0x4004004) executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updsa={0x104, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private0, @in=@multicast2}, {@in6=@local, 0x1, 0x3c}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in6=@dev}]}, 0x104}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 bisect: split chunks (needed=true): <10> bisect: split chunk #0 of len 10 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 24, 5, 9] detailed listing: executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updsa={0x104, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private0, @in=@multicast2}, {@in6=@local, 0x1, 0x3c}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in6=@dev}]}, 0x104}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <5> bisect: split chunk #0 of len 5 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [5, 9] detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 24] detailed listing: executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updsa={0x104, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private0, @in=@multicast2}, {@in6=@local, 0x1, 0x3c}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in6=@dev}]}, 0x104}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) program did not crash bisect: split chunks (needed=true): <3>, <2> bisect: split chunk #0 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [24, 5, 9] detailed listing: executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 5, 9] detailed listing: executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updsa={0x104, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private0, @in=@multicast2}, {@in6=@local, 0x1, 0x3c}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in6=@dev}]}, 0x104}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program did not crash bisect: split chunk #1 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 24, 9] detailed listing: executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updsa={0x104, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private0, @in=@multicast2}, {@in6=@local, 0x1, 0x3c}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in6=@dev}]}, 0x104}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 1: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32, 0xb}, 0x9c) sendmsg$RDMA_NLDEV_CMD_STAT_SET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="2000000010840ec6eddba41401002cbd7000fedbdf2508000100000000000800150000000000"], 0x20}, 0x1, 0x0, 0x0, 0x20000011}, 0x0) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000a00)={0x0, @in6={{0xa, 0x4e23, 0x0, @loopback}}, 0x0, 0x0, 0x0, 0x0, 0x54}, 0x9c) mmap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x1000000, 0x4010, 0xffffffffffffffff, 0x3a838000) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), 0xffffffffffffffff) recvfrom$inet6(r0, &(0x7f0000000ac0)=""/4096, 0x1000, 0x100, &(0x7f00000000c0)={0xa, 0x4e24, 0x8001, @private1={0xfc, 0x1, '\x00', 0x1}, 0xe90}, 0x1c) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=6m1s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 3, 24, 5] detailed listing: executing program 1: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) (async) r1 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) socket$packet(0x11, 0x2, 0x300) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x5, 0xb68, 0x560b0000, &(0x7f0000000000)="259a53f271a76d2688ca4c6588a8", 0x0, 0xd01, 0x2a0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) sendmsg$nl_xfrm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@updsa={0x104, 0x1a, 0x1, 0x0, 0x0, {{@in6=@private0, @in=@multicast2}, {@in6=@local, 0x1, 0x3c}, @in=@multicast1, {}, {}, {}, 0x0, 0x0, 0xa}, [@coaddr={0x14, 0xe, @in6=@dev}]}, 0x104}}, 0x0) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_complete bisect: the chunk can be dropped bisect: split chunks (needed=true): <2>, <1>, <1> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=6m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [3, 24, 5] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunk #2 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunks (needed=true): <1>, <1, final>, <1, final> bisect: split chunk #0 of len 1 into 2 parts bisect: no way to further split the chunk bisect: 3 programs left: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="580000001000090600"/20, @ANYRES32=0x0, @ANYBLOB="adffa888000000001c00128009000100766c616e000000000c000280060001000000000008000500", @ANYRES32, @ANYRESHEX=0x0], 0x58}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) bisect: trying to concatenate bisect: concatenate 3 entries minimizing program #0 before concatenation testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [2, 24, 5] detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="280000002a00090000000000000000000a00000008000300", @ANYRES32=0x0, @ANYBLOB="0c0001"], 0x28}}, 0x0) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_sync testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [1, 24, 5] detailed listing: executing program 0: socket$nl_generic(0x10, 0x3, 0x10) executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 24, 5] detailed listing: executing program 0: executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001800599c6d0eab070004000523"], 0xfe33) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_complete minimized 3 calls -> 0 calls minimizing program #1 before concatenation testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 23, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) socket$kcm(0x10, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a5c000000060a09040000000000000000020000000900020073797a32000000000900010073797a3000000000300004"], 0x84}}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 22, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) socket$kcm(0x10, 0x2, 0x0) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: KASAN: slab-use-after-free Read in mgmt_pending_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 21, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907009875f37538e486dd6317ce620300fe"], 0xfe1b) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 20, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 19, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000000)=@in6={0xa, 0x0, 0x0, @mcast1}, 0x80, 0x0}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 18, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d80000001c0081044e81f782db44b9040a1d08030e000000e8fea4a1180015000600142603600e1208000f1000810401a80016000a0001", 0x37}], 0x1, 0x0, 0x0, 0x7400}, 0x0) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 17, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)={'batadv0\x00', 0x0}) socket$nl_route(0x10, 0x3, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) sendmsg(r2, &(0x7f0000000440)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x9, 0x6, @broadcast}, 0x80, &(0x7f0000000500)=[{&(0x7f0000000000)="4bbf2c4cfd81685544f46c3f0800", 0xe}], 0x1, 0x0, 0x0, 0x11000000}, 0x1) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 16, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r2, &(0x7f0000000640)={@val={0x0, 0x86dd}, @val={0x0, 0x4, 0x11, 0x4}, @mpls={[], @ipv6=@gre_packet={0xe, 0x6, "ec00be", 0x44, 0x2f, 0x1, @ipv4={'\x00', '\xff\xff', @loopback}, @mcast2, {[], {{0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x1, 0x88be, 0x0, 0x3}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1}, {0x8, 0x88be, 0x2, {{0x6, 0x1, 0x9, 0x2, 0x1, 0x0, 0x0, 0x5}, 0x1, {0x10}}}, {0x8, 0x22eb, 0x0, {{0x0, 0x2, 0x4, 0x0, 0x0, 0x2, 0x7, 0x8}, 0x2, {0x2, 0x4, 0x0, 0x5, 0x1, 0x1, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}, 0x7a) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 15, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) r3 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 14, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) socket$kcm(0x2, 0xa, 0x2) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 13, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 12, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) bpf$PROG_LOAD(0x5, 0x0, 0x0) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 11, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 10, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)) socket$nl_route(0x10, 0x3, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: KASAN: slab-use-after-free Read in mgmt_pending_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 9, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)) socket$nl_route(0x10, 0x3, 0x0) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 8, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x11, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000001140)) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 7, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_route(0x10, 0x3, 0x0) socket$nl_generic(0x11, 0x3, 0x10) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 6, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) socket$nl_route(0x10, 0x3, 0x0) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 5, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0xd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 4, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$sock_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000140)) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: KASAN: slab-use-after-free Read in mgmt_pending_remove testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2, 5] detailed listing: executing program 0: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 2, 5] detailed listing: executing program 0: executing program 0: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0x0, 0x1}, 0x6) program did not crash minimized 24 calls -> 3 calls minimizing program #2 before concatenation testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 4] detailed listing: executing program 0: executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r1, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) program crashed: KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_sync testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 3] detailed listing: executing program 0: executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) executing program 0: syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = socket$inet_udplite(0x2, 0x2, 0x88) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000040)=@broute={'broute\x00', 0x20, 0x1, 0x1a8, [0x0, 0x0, 0x0, 0x0, 0x0, 0x20000480], 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000001b000012000000004b28c962170b7020000000000000000000000000000000ffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000086dd6361696630000000000000000000000076657468315f746f5f7465616d00000073797a6b616c6c65723100000000000076657468315f746f5f7465616d000000aaaaaaaaaabb0000000000000180c20000000000000000000000e8000000e80000001801000069703600000100000000000009000000000300000000000000000000000000005000000000000000fe80000000000000000000000000000000000000000000000000ffffac1e00707154f51b8b0980f73a0f35ca6a4100000000000000000000004000000000000000000080000000000000010000000000063e004904004a194dc2f70d04a500000000000000000000000800000000000400"/424]}, 0x220) program did not crash testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 3] detailed listing: executing program 0: executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) socket$inet_udplite(0x2, 0x2, 0x88) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) program crashed: KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_sync testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 2] detailed listing: executing program 0: executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) program crashed: KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_sync testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [0, 3, 1] detailed listing: executing program 0: executing program 4: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) executing program 0: ioctl$HCIINQUIRY(0xffffffffffffffff, 0x400448ca, 0x0) program did not crash minimized 5 calls -> 2 calls testing program (duration=9m0s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) program crashed: KASAN: slab-use-after-free Read in mgmt_remove_adv_monitor_sync bisect: concatenation succeeded found reproducer with 5 syscalls minimizing guilty program testing program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) program did not crash testing program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-ioctl$HCIINQUIRY detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) ioctl$HCIINQUIRY(0xffffffffffffffff, 0x400448ca, 0x0) program did not crash testing program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) program did not crash testing program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) program did not crash testing program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY detailed listing: executing program 0: bind$bt_hci(0xffffffffffffffff, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(0xffffffffffffffff, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r0, 0x400448ca, 0x0) program did not crash testing program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, 0x0, 0x0) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB="5300000002"], 0x8) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) program did not crash testing program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, 0x0, 0x8) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) program did not crash testing program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY detailed listing: executing program 0: r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write$bt_hci(r0, &(0x7f0000000580)=ANY=[@ANYBLOB], 0x8) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$HCIINQUIRY(r1, 0x400448ca, 0x0) program did not crash extracting C reproducer testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program crashed: possible deadlock in mgmt_remove_adv_monitor_complete simplifying C reproducer testing compiled C program (duration=3m25.522243546s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program crashed: possible deadlock in mgmt_remove_adv_monitor_complete testing compiled C program (duration=3m25.522243546s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:true Trace:false LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_init_net_socket$bt_hci-bind$bt_hci-write$bt_hci-syz_init_net_socket$bt_hci-ioctl$HCIINQUIRY program did not crash reproducing took 4h25m45.555379825s repro crashed as (corrupted=false): Bluetooth: MGMT ver 1.23 ============================================ WARNING: possible recursive locking detected 6.13.0-rc1-syzkaller-00170-g896d8946da97 #0 Not tainted -------------------------------------------- syz-executor392/5937 is trying to acquire lock: ffff88807ebdc078 (&hdev->lock){+.+.}-{4:4}, at: mgmt_remove_adv_monitor_complete+0xaf/0x550 net/bluetooth/mgmt.c:5524 but task is already holding lock: ffff88807ebdc078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x5c8/0x11c0 net/bluetooth/hci_sync.c:5200 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&hdev->lock); lock(&hdev->lock); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by syz-executor392/5937: #0: ffff88807ebdcd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline] #0: ffff88807ebdcd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_close+0x10a/0x210 net/bluetooth/hci_core.c:508 #1: ffff88807ebdc078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x5c8/0x11c0 net/bluetooth/hci_sync.c:5200 #2: ffff88807ebdc690 (&hdev->cmd_sync_work_lock){+.+.}-{4:4} , at: hci_cmd_sync_dequeue+0x44/0x3d0 net/bluetooth/hci_sync.c:887 stack backtrace: CPU: 1 UID: 0 PID: 5937 Comm: syz-executor392 Not tainted 6.13.0-rc1-syzkaller-00170-g896d8946da97 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3037 check_deadlock kernel/locking/lockdep.c:3089 [inline] validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3891 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735 mgmt_remove_adv_monitor_complete+0xaf/0x550 net/bluetooth/mgmt.c:5524 _hci_cmd_sync_cancel_entry net/bluetooth/hci_sync.c:645 [inline] hci_cmd_sync_dequeue+0x22b/0x3d0 net/bluetooth/hci_sync.c:890 cmd_complete_rsp+0x4c/0x180 net/bluetooth/mgmt.c:1469 mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550 hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508 sock_do_ioctl+0x158/0x460 net/socket.c:1209 sock_ioctl+0x626/0x8e0 net/socket.c:1328 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1a4a588569 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1f 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f1a49d32168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f1a4a6121c8 RCX: 00007f1a4a588569 RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000005 RBP: 00007f1a4a6121c0 R08: 00007f1a49d326c0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1a4a6121cc R13: 000000000000000b R14: 00007ffd0cce3530 R15: 00007ffd0cce3618 final repro crashed as (corrupted=false): Bluetooth: MGMT ver 1.23 ============================================ WARNING: possible recursive locking detected 6.13.0-rc1-syzkaller-00170-g896d8946da97 #0 Not tainted -------------------------------------------- syz-executor392/5937 is trying to acquire lock: ffff88807ebdc078 (&hdev->lock){+.+.}-{4:4}, at: mgmt_remove_adv_monitor_complete+0xaf/0x550 net/bluetooth/mgmt.c:5524 but task is already holding lock: ffff88807ebdc078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x5c8/0x11c0 net/bluetooth/hci_sync.c:5200 other info that might help us debug this: Possible unsafe locking scenario: CPU0 ---- lock(&hdev->lock); lock(&hdev->lock); *** DEADLOCK *** May be due to missing lock nesting notation 3 locks held by syz-executor392/5937: #0: ffff88807ebdcd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close net/bluetooth/hci_core.c:481 [inline] #0: ffff88807ebdcd80 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_close+0x10a/0x210 net/bluetooth/hci_core.c:508 #1: ffff88807ebdc078 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x5c8/0x11c0 net/bluetooth/hci_sync.c:5200 #2: ffff88807ebdc690 (&hdev->cmd_sync_work_lock){+.+.}-{4:4} , at: hci_cmd_sync_dequeue+0x44/0x3d0 net/bluetooth/hci_sync.c:887 stack backtrace: CPU: 1 UID: 0 PID: 5937 Comm: syz-executor392 Not tainted 6.13.0-rc1-syzkaller-00170-g896d8946da97 #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120 print_deadlock_bug+0x483/0x620 kernel/locking/lockdep.c:3037 check_deadlock kernel/locking/lockdep.c:3089 [inline] validate_chain+0x15e2/0x5920 kernel/locking/lockdep.c:3891 __lock_acquire+0x1397/0x2100 kernel/locking/lockdep.c:5226 lock_acquire+0x1ed/0x550 kernel/locking/lockdep.c:5849 __mutex_lock_common kernel/locking/mutex.c:585 [inline] __mutex_lock+0x1ac/0xee0 kernel/locking/mutex.c:735 mgmt_remove_adv_monitor_complete+0xaf/0x550 net/bluetooth/mgmt.c:5524 _hci_cmd_sync_cancel_entry net/bluetooth/hci_sync.c:645 [inline] hci_cmd_sync_dequeue+0x22b/0x3d0 net/bluetooth/hci_sync.c:890 cmd_complete_rsp+0x4c/0x180 net/bluetooth/mgmt.c:1469 mgmt_pending_foreach+0xd1/0x130 net/bluetooth/mgmt_util.c:259 __mgmt_power_off+0x183/0x430 net/bluetooth/mgmt.c:9550 hci_dev_close_sync+0x6c4/0x11c0 net/bluetooth/hci_sync.c:5208 hci_dev_do_close net/bluetooth/hci_core.c:483 [inline] hci_dev_close+0x112/0x210 net/bluetooth/hci_core.c:508 sock_do_ioctl+0x158/0x460 net/socket.c:1209 sock_ioctl+0x626/0x8e0 net/socket.c:1328 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl+0xf5/0x170 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1a4a588569 Code: 28 00 00 00 75 05 48 83 c4 28 c3 e8 f1 1f 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f1a49d32168 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 RAX: ffffffffffffffda RBX: 00007f1a4a6121c8 RCX: 00007f1a4a588569 RDX: 0000000000000000 RSI: 00000000400448ca RDI: 0000000000000005 RBP: 00007f1a4a6121c0 R08: 00007f1a49d326c0 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 00007f1a4a6121cc R13: 000000000000000b R14: 00007ffd0cce3530 R15: 00007ffd0cce3618